Skip to content

Commit 54f1792

Browse files
committed
mtdparts: Fix various issues reported by Coverity
Now that sandbox is building cmd/mtdparts.c Coverity has looked at the code and found a number of issues. In index_partitions() it is possible that part will be NULL, so re-work the checks and debug statements to take this into account. We have a number of string buffers that we print to in the exact size of, and use string functions on, so we need to ensure they are large enough to be NULL terminated. In device_parse() it is not possible for num_partitions to be 0 (we would have hit a different error first) so remove logically dead code. Finally, in parse_mtdparts() if we have an error we need to free the memory allocated to dev. Cc: Lothar Waßmann <[email protected]> Cc: Maxime Ripard <[email protected]> Reported-by: Coverity (CID: 166334, 166333, 166332, 166329, 166328) Signed-off-by: Tom Rini <[email protected]>
1 parent 78eda89 commit 54f1792

File tree

1 file changed

+18
-15
lines changed

1 file changed

+18
-15
lines changed

cmd/mtdparts.c

Lines changed: 18 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -133,9 +133,9 @@ static const char *mtdparts_default = MTDPARTS_DEFAULT;
133133
#define MTDIDS_MAXLEN 128
134134
#define MTDPARTS_MAXLEN 512
135135
#define PARTITION_MAXLEN 16
136-
static char last_ids[MTDIDS_MAXLEN];
137-
static char last_parts[MTDPARTS_MAXLEN];
138-
static char last_partition[PARTITION_MAXLEN];
136+
static char last_ids[MTDIDS_MAXLEN + 1];
137+
static char last_parts[MTDPARTS_MAXLEN + 1];
138+
static char last_partition[PARTITION_MAXLEN + 1];
139139

140140
/* low level jffs2 cache cleaning routine */
141141
extern void jffs2_free_cache(struct part_info *part);
@@ -240,15 +240,22 @@ static void index_partitions(void)
240240
if (dev == current_mtd_dev) {
241241
mtddevnum += current_mtd_partnum;
242242
env_set_ulong("mtddevnum", mtddevnum);
243+
debug("=> mtddevnum %d,\n", mtddevnum);
243244
break;
244245
}
245246
mtddevnum += dev->num_parts;
246247
}
247248

248249
part = mtd_part_info(current_mtd_dev, current_mtd_partnum);
249-
env_set("mtddevname", part->name);
250+
if (part) {
251+
env_set("mtddevname", part->name);
252+
253+
debug("=> mtddevname %s\n", part->name);
254+
} else {
255+
env_set("mtddevname", NULL);
250256

251-
debug("=> mtddevnum %d,\n=> mtddevname %s\n", mtddevnum, part->name);
257+
debug("=> mtddevname NULL\n");
258+
}
252259
} else {
253260
env_set("mtddevnum", NULL);
254261
env_set("mtddevname", NULL);
@@ -912,12 +919,6 @@ static int device_parse(const char *const mtd_dev, const char **ret, struct mtd_
912919
return 1;
913920
}
914921

915-
if (num_parts == 0) {
916-
printf("no partitions for device %s%d (%s)\n",
917-
MTD_DEV_TYPE(id->type), id->num, id->mtd_id);
918-
return 1;
919-
}
920-
921922
debug("\ntotal partitions: %d\n", num_parts);
922923

923924
/* check for next device presence */
@@ -1593,8 +1594,10 @@ static int parse_mtdparts(const char *const mtdparts)
15931594
list_add_tail(&dev->link, &devices);
15941595
err = 0;
15951596
}
1596-
if (err == 1)
1597+
if (err == 1) {
1598+
free(dev);
15971599
device_delall(&devices);
1600+
}
15981601

15991602
return err;
16001603
}
@@ -1730,9 +1733,9 @@ int mtdparts_init(void)
17301733
if (!initialized) {
17311734
INIT_LIST_HEAD(&mtdids);
17321735
INIT_LIST_HEAD(&devices);
1733-
memset(last_ids, 0, MTDIDS_MAXLEN);
1734-
memset(last_parts, 0, MTDPARTS_MAXLEN);
1735-
memset(last_partition, 0, PARTITION_MAXLEN);
1736+
memset(last_ids, 0, sizeof(last_ids));
1737+
memset(last_parts, 0, sizeof(last_parts));
1738+
memset(last_partition, 0, sizeof(last_partition));
17361739
#if defined(CONFIG_SYS_MTDPARTS_RUNTIME)
17371740
board_mtdparts_default(&mtdids_default, &mtdparts_default);
17381741
#endif

0 commit comments

Comments
 (0)