[U-Boot-Users] Possible problem in cmd_nvedit.c

[Neil Bryan]

Hello U-boot group.

Whilst working in the above file, I noticed a possible bug in:

int do_printenv (cmd_tbl_t *cmdtp, int flag, int argc, char *argv[])
{
   int i, j, k, nxt;
   int rcode = 0;

	if (argc == 1) {	/* Print all env variables	*/
		for (i=0; env_get_char(i) != '\0'; i=nxt+1) {
<SNIP>

The problem is with nxt.  Now unless something magical is happening
it appears to me that nxt is used without initialisation to modify
i in the for-loop.

I checked the values before and after use and the dissasembly is here
for you ARM assembly gurus.  The worrying thing is that it
appears to work but is contains an address previous to its first use.

Regards,

Neil.

21f09584 <do_printenv>:
21f09584:	e1a0c00d 	mov	ip, sp
21f09588:	e92ddef0 	stmdb	sp!, {r4, r5, r6, r7, r9, sl, fp, ip, lr, pc}
21f0958c:	e24cb004 	sub	fp, ip, #4	; 0x4
21f09590:	e3a01000 	mov	r1, #0	; 0x0
21f09594:	e1a09002 	mov	r9, r2
21f09598:	e59f0168 	ldr	r0, [pc, #168]	; 21f09708 <do_printenv+0x184>
21f0959c:	e24dd008 	sub	sp, sp, #8	; 0x8
21f095a0:	e50b102c 	str	r1, [fp, -#44]
21f095a4:	e1a01005 	mov	r1, r5
21f095a8:	e50b3028 	str	r3, [fp, -#40]
21f095ac:	eb0003c6 	bl	21f0a4cc <printf>
21f095b0:	e3590001 	cmp	r9, #1	; 0x1
21f095b4:	1a00002d 	bne	21f09670 <do_printenv+0xec>
21f095b8:	e51b702c 	ldr	r7, [fp, -#44]
21f095bc:	ea000018 	b	21f09624 <do_printenv+0xa0>
21f095c0:	e1a05007 	mov	r5, r7
21f095c4:	ea000000 	b	21f095cc <do_printenv+0x48>
21f095c8:	e2855001 	add	r5, r5, #1	; 0x1
21f095cc:	e1a00005 	mov	r0, r5
21f095d0:	e1a0e00f 	mov	lr, pc
21f095d4:	e596f000 	ldr	pc, [r6]
21f095d8:	e31000ff 	tst	r0, #255	; 0xff
21f095dc:	1afffff9 	bne	21f095c8 <do_printenv+0x44>
21f095e0:	e1a04007 	mov	r4, r7
21f095e4:	e1540005 	cmp	r4, r5
21f095e8:	aa000007 	bge	21f0960c <do_printenv+0x88>
21f095ec:	e1a00004 	mov	r0, r4
21f095f0:	e1a0e00f 	mov	lr, pc
21f095f4:	e596f000 	ldr	pc, [r6]
21f095f8:	e20000ff 	and	r0, r0, #255	; 0xff
21f095fc:	eb000398 	bl	21f0a464 <putc>
21f09600:	e2844001 	add	r4, r4, #1	; 0x1
21f09604:	e1540005 	cmp	r4, r5
21f09608:	bafffff7 	blt	21f095ec <do_printenv+0x68>
21f0960c:	e3a0000a 	mov	r0, #10	; 0xa
21f09610:	eb000393 	bl	21f0a464 <putc>
21f09614:	eb0003c6 	bl	21f0a534 <ctrlc>
21f09618:	e3500000 	cmp	r0, #0	; 0x0
21f0961c:	1a00000f 	bne	21f09660 <do_printenv+0xdc>
21f09620:	e2857001 	add	r7, r5, #1	; 0x1
21f09624:	e59f60e0 	ldr	r6, [pc, #e0]	; 21f0970c <do_printenv+0x188>
21f09628:	e1a00007 	mov	r0, r7
21f0962c:	e1a0e00f 	mov	lr, pc
21f09630:	e596f000 	ldr	pc, [r6]
21f09634:	e21040ff 	ands	r4, r0, #255	; 0xff
21f09638:	1affffe0 	bne	21f095c0 <do_printenv+0x3c>
21f0963c:	e59f00cc 	ldr	r0, [pc, #cc]	; 21f09710 <do_printenv+0x18c>
21f09640:	e1a01005 	mov	r1, r5
21f09644:	eb0003a0 	bl	21f0a4cc <printf>
21f09648:	e1a01007 	mov	r1, r7
21f0964c:	e59f00c0 	ldr	r0, [pc, #c0]	; 21f09714 <do_printenv+0x190>
21f09650:	e3a02fff 	mov	r2, #1020	; 0x3fc
21f09654:	eb00039c 	bl	21f0a4cc <printf>
21f09658:	e1a00004 	mov	r0, r4
21f0965c:	ea000041 	b	21f09768 <do_printenv+0x1e4>
21f09660:	e59f00b0 	ldr	r0, [pc, #b0]	; 21f09718 <do_printenv+0x194>
21f09664:	eb00038b 	bl	21f0a498 <puts>
21f09668:	e3a00001 	mov	r0, #1	; 0x1
21f0966c:	ea00003d 	b	21f09768 <do_printenv+0x1e4>
21f09670:	e3a07001 	mov	r7, #1	; 0x1
21f09674:	e1570009 	cmp	r7, r9
21f09678:	aa000039 	bge	21f09764 <do_printenv+0x1e0>
21f0967c:	e51b3028 	ldr	r3, [fp, -#40]
21f09680:	e3e04000 	mvn	r4, #0	; 0x0
21f09684:	e793a107 	ldr	sl, [r3, r7, lsl #2]
21f09688:	e3a06000 	mov	r6, #0	; 0x0
21f0968c:	ea000023 	b	21f09720 <do_printenv+0x19c>
21f09690:	e1a05006 	mov	r5, r6
21f09694:	ea000000 	b	21f0969c <do_printenv+0x118>
21f09698:	e2855001 	add	r5, r5, #1	; 0x1
21f0969c:	e59f1068 	ldr	r1, [pc, #68]	; 21f0970c <do_printenv+0x188>
21f096a0:	e1a00005 	mov	r0, r5
21f096a4:	e1a0e00f 	mov	lr, pc
21f096a8:	e591f000 	ldr	pc, [r1]
21f096ac:	e31000ff 	tst	r0, #255	; 0xff
21f096b0:	1afffff8 	bne	21f09698 <do_printenv+0x114>
21f096b4:	e1a0000a 	mov	r0, sl
21f096b8:	e1a01006 	mov	r1, r6
21f096bc:	eb0001f5 	bl	21f09e98 <envmatch>
21f096c0:	e2504000 	subs	r4, r0, #0	; 0x0
21f096c4:	ba000014 	blt	21f0971c <do_printenv+0x198>
21f096c8:	e1a0000a 	mov	r0, sl
21f096cc:	eb000371 	bl	21f0a498 <puts>
21f096d0:	e3a0003d 	mov	r0, #61	; 0x3d
21f096d4:	ea000005 	b	21f096f0 <do_printenv+0x16c>
21f096d8:	e1a00004 	mov	r0, r4
21f096dc:	e59f3028 	ldr	r3, [pc, #28]	; 21f0970c <do_printenv+0x188>
21f096e0:	e2844001 	add	r4, r4, #1	; 0x1
21f096e4:	e1a0e00f 	mov	lr, pc
21f096e8:	e593f000 	ldr	pc, [r3]
21f096ec:	e20000ff 	and	r0, r0, #255	; 0xff
21f096f0:	eb00035b 	bl	21f0a464 <putc>
21f096f4:	e1540005 	cmp	r4, r5
21f096f8:	bafffff6 	blt	21f096d8 <do_printenv+0x154>
21f096fc:	e3a0000a 	mov	r0, #10	; 0xa
21f09700:	eb000357 	bl	21f0a464 <putc>
21f09704:	ea00000b 	b	21f09738 <do_printenv+0x1b4>
21f09708:	21f155dc 	ldrcssb	r5, [r1, #92]!
21f0970c:	21f16c04 	mvncss	r6, r4, lsl #24
21f09710:	21f155f8 	ldrcssh	r5, [r1, #88]!
21f09714:	21f15608 	mvncss	r5, r8, lsl #12
21f09718:	21f155ec 	mvncss	r5, ip, ror #11
21f0971c:	e2856001 	add	r6, r5, #1	; 0x1
21f09720:	e59f1044 	ldr	r1, [pc, #44]	; 21f0976c <do_printenv+0x1e8>
21f09724:	e1a00006 	mov	r0, r6
21f09728:	e1a0e00f 	mov	lr, pc
21f0972c:	e591f000 	ldr	pc, [r1]
21f09730:	e31000ff 	tst	r0, #255	; 0xff
21f09734:	1affffd5 	bne	21f09690 <do_printenv+0x10c>
21f09738:	e3540000 	cmp	r4, #0	; 0x0
21f0973c:	aa000005 	bge	21f09758 <do_printenv+0x1d4>
21f09740:	e51b302c 	ldr	r3, [fp, -#44]
21f09744:	e1a0100a 	mov	r1, sl
21f09748:	e59f0020 	ldr	r0, [pc, #20]	; 21f09770 <do_printenv+0x1ec>
21f0974c:	e2833001 	add	r3, r3, #1	; 0x1
21f09750:	e50b302c 	str	r3, [fp, -#44]
21f09754:	eb00035c 	bl	21f0a4cc <printf>
21f09758:	e2877001 	add	r7, r7, #1	; 0x1
21f0975c:	e1570009 	cmp	r7, r9
21f09760:	baffffc5 	blt	21f0967c <do_printenv+0xf8>
21f09764:	e51b002c 	ldr	r0, [fp, -#44]
21f09768:	ea000001 	b	21f09774 <do_printenv+0x1f0>
21f0976c:	21f16c04 	mvncss	r6, r4, lsl #24
21f09770:	21f15628 	mvncss	r5, r8, lsr #12
21f09774:	e91baef0 	ldmdb	fp, {r4, r5, r6, r7, r9, sl, fp, sp, pc}