diff options
author | Patrick Wildt <patrick@blueri.se> | 2017-05-10 22:18:54 +0200 |
---|---|---|
committer | Stefan Roese <sr@denx.de> | 2017-05-31 07:43:04 +0200 |
commit | 6cbf7eda3cbe0f8cbaa84b4daaa86dfa2a696a77 (patch) | |
tree | 76eaed955cbd27a43f46ec70d805b5f886336ae4 /drivers/sysreset/Kconfig | |
parent | f3d9ec2a6926bd436f15298ab9cebab061ab159a (diff) |
arm: mvebu: kwbimage: inline function to fix use-after-free
image_version_file()'s only use is to return the version number of the
specified image, and it's only called by kwbimage_generate(). This
version function mallocs "image_cfg" and reads the contents of the image
into that buffer. Before return to its caller it frees the buffer.
After extracting the version, kwb_image_generate() tries to calculate
the header size by calling image_headersz_v1(). This function now
accesses "image_cfg", which has already been freed.
Since image_version_file() is only used by a single function, inline it
into kwbimage_generate() and only free the buffer after it is no longer
needed. This also improves code readability since the code is mostly
equal to kwbimage_set_header().
Signed-off-by: Patrick Wildt <patrick@blueri.se>
Signed-off-by: Stefan Roese <sr@denx.de>
Diffstat (limited to 'drivers/sysreset/Kconfig')
0 files changed, 0 insertions, 0 deletions