Angel Pons submitted this change.

View Change

Approvals: build bot (Jenkins): Verified HAOUAS Elyes: Looks good to me, approved Edward O'Callaghan: Looks good to me, approved
ft2232_spi.c: Improve handling of static buffer

If `buf` became NULL because of an error, subsequent calls to the
`ft2232_spi_send_command` function with a smaller buffer size will
result in a null pointer dereference. Add an additional null check
before using `buf` to prevent that. Moreover, use `size_t` for the
`bufsize` and `oldbufsize` variables, as it's what `realloc` uses.

Change-Id: Idc4237ddca94c42ce2a930e6d00fd2d14e4f125c
Signed-off-by: Angel Pons <th3fanbus@gmail.com>
Reviewed-on: https://review.coreboot.org/c/flashrom/+/39975
Reviewed-by: HAOUAS Elyes <ehaouas@noos.fr>
Reviewed-by: Edward O'Callaghan <quasisec@chromium.org>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
---
M ft2232_spi.c
1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ft2232_spi.c b/ft2232_spi.c
index 520eb6e..9f4c7f0 100644
--- a/ft2232_spi.c
+++ b/ft2232_spi.c
@@ -468,8 +468,8 @@
static unsigned char *buf = NULL;
/* failed is special. We use bitwise ops, but it is essentially bool. */
int i = 0, ret = 0, failed = 0;
- int bufsize;
- static int oldbufsize = 0;
+ size_t bufsize;
+ static size_t oldbufsize = 0;

if (writecnt > 65536 || readcnt > 65536)
return SPI_INVALID_LENGTH;
@@ -477,7 +477,7 @@
/* buf is not used for the response from the chip. */
bufsize = max(writecnt + 9, 260 + 9);
/* Never shrink. realloc() calls are expensive. */
- if (bufsize > oldbufsize) {
+ if (!buf || bufsize > oldbufsize) {
buf = realloc(buf, bufsize);
if (!buf) {
msg_perr("Out of memory!\n");

To view, visit change 39975. To unsubscribe, or for help writing mail filters, visit settings.

Gerrit-Project: flashrom
Gerrit-Branch: master
Gerrit-Change-Id: Idc4237ddca94c42ce2a930e6d00fd2d14e4f125c
Gerrit-Change-Number: 39975
Gerrit-PatchSet: 5
Gerrit-Owner: Angel Pons <th3fanbus@gmail.com>
Gerrit-Reviewer: Angel Pons <th3fanbus@gmail.com>
Gerrit-Reviewer: David Hendricks <david.hendricks@gmail.com>
Gerrit-Reviewer: Edward O'Callaghan <quasisec@chromium.org>
Gerrit-Reviewer: HAOUAS Elyes <ehaouas@noos.fr>
Gerrit-Reviewer: Nico Huber <nico.h@gmx.de>
Gerrit-Reviewer: Patrick Georgi <pgeorgi@google.com>
Gerrit-Reviewer: Stefan Reinauer <stefan.reinauer@coreboot.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply@coreboot.org>
Gerrit-CC: Paul Menzel <paulepanter@users.sourceforge.net>
Gerrit-MessageType: merged