[U-Boot] [PATCH v2] cmd: fastboot: Validate user input

[Lukasz Majewski]

Hi Sam,

> On Sat, Jun 30, 2018 at 7:20 AM, Simon Glass <sjg at chromium.org> wrote:
> > On 29 June 2018 at 11:59, Sam Protsenko
> > <semen.protsenko at linaro.org> wrote:  
> >> In case when user provides '-' as USB controller index, like this:
> >>  
> >>     => fastboot -  
> >>
> >> data abort occurs in strcmp() function in do_fastboot(), here:
> >>
> >>     if (!strcmp(argv[1], "udp"))
> >>
> >> (tested on BeagleBone Black).
> >>
> >> That's because argv[1] is NULL when user types in the '-', and null
> >> pointer dereference occurs in strcmp() (which is ok according to C
> >> standard specification). So we must validate user input to prevent
> >> such behavior.
> >>
> >> While at it, check also the result of strtoul() function and handle
> >> error cases properly.
> >>
> >> Signed-off-by: Sam Protsenko <semen.protsenko at linaro.org>
> >> ---
> >> Changes for v2:
> >>   - replace argv check with argc check
> >>   - add mentioning of testing platform in commit message
> >>
> >>  cmd/fastboot.c | 13 ++++++++++++-
> >>  1 file changed, 12 insertions(+), 1 deletion(-)  
> >
> > Reviewed-by: Simon Glass <sjg at chromium.org>  
> 
> Hi Lukasz,
> 
> Can you please review and merge?

I've noticed that I was not CC'ed, so I've missed the patch from the
mailing list.
You may consider using patman for sending patches (which adds
recipients automatically).


The patch itself seems OK - thanks.

Reviewed-by: Lukasz Majewski <lukma at denx.de>

I've added it to u-boot-dfu tree. Lets wait for Travis-CI output.

> 
> Thanks!




Best regards,

Lukasz Majewski

--

DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20180724/a154b52f/attachment.sig>