[flashrom-gerrit] [S] Change in flashrom[1.1.x]: it87spi.c: Prevent use-after-free bug

[Felix Singer (Code Review)]

Felix Singer has submitted this change. ( https://review.coreboot.org/c/flashrom/+/67851 )

Change subject: it87spi.c: Prevent use-after-free bug
......................................................................

it87spi.c: Prevent use-after-free bug

The memory for the `param` string is aliased by `dualbiosindex_suffix`.
Moreover, `errno` could have been modified by the call to `free()`.
Therefore, only free the former when there are no more uses of either.

Change-Id: I79f18f6077c77c0cbb8bfa431e17f9b079f11c95
Signed-off-by: Angel Pons 
Reviewed-on: https://review.coreboot.org/c/flashrom/+/46551
Tested-by: build bot (Jenkins) 
Reviewed-by: Nico Huber 
Reviewed-on: https://review.coreboot.org/c/flashrom/+/67851
Reviewed-by: Felix Singer 
---
M it87spi.c
1 file changed, 21 insertions(+), 1 deletion(-)

Approvals:
  build bot (Jenkins): Verified
  Felix Singer: Looks good to me, approved

diff --git a/it87spi.c b/it87spi.c
index df9f664..7517be4 100644
--- a/it87spi.c
+++ b/it87spi.c
@@ -135,12 +135,13 @@
    		char *dualbiosindex_suffix;
    		errno = 0;
    		long chip_index = strtol(param, &dualbiosindex_suffix, 0);
-			free(param);
    		if (errno != 0 || *dualbiosindex_suffix != '\0' || chip_index < 0 || chip_index > 1) {
    			msg_perr("DualBIOS: Invalid chip index requested - choose 0 or 1.\n");
+				free(param);
    			exit_conf_mode_ite(port);
    			return 1;
    		}
+			free(param);
    		if (chip_index != (tmp & 1)) {
    			msg_pdbg("DualBIOS: Previous chip index: %d\n", tmp & 1);
    			sio_write(port, 0xEF, (tmp & 0xFE) | chip_index);