[PATCH] bootstd: android: avoid possible null pointer dereference

[Mattijs Korpershoek]

Hi Gary,

Thank you for the patch.

On mer., avril 02, 2025 at 16:42, Gary Bisson <bisson.gary at gmail.com> wrote:

> - avb_slot_verify_data_free() doesn't check its data parameter
> - out_data can be null if avb_slot_verify() fails to allocate memory
>
> Signed-off-by: Gary Bisson <bisson.gary at gmail.com>

Reviewed-by: Mattijs Korpershoek <mkorpershoek at kernel.org>

> ---
> Another approach would be to fix avb_slot_verify_data_free() to check
> its paramter but I believe the goal is not to touch libavb to be closer
> to upstream.
> ---
>  boot/bootmeth_android.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/boot/bootmeth_android.c b/boot/bootmeth_android.c
> index 3a59a4e3f6..f431b6ae58 100644
> --- a/boot/bootmeth_android.c
> +++ b/boot/bootmeth_android.c
> @@ -481,7 +481,8 @@ static int run_avb_verification(struct bootflow *bflow)
>  		if (result != AVB_SLOT_VERIFY_RESULT_OK) {
>  			printf("Verification failed, reason: %s\n",
>  			       str_avb_slot_error(result));
> -			avb_slot_verify_data_free(out_data);
> +			if (out_data)
> +				avb_slot_verify_data_free(out_data);
>  			return log_msg_ret("avb verify", -EIO);
>  		}
>  		boot_state = AVB_GREEN;
> @@ -491,7 +492,8 @@ static int run_avb_verification(struct bootflow *bflow)
>  		    result != AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION) {
>  			printf("Unlocked verification failed, reason: %s\n",
>  			       str_avb_slot_error(result));
> -			avb_slot_verify_data_free(out_data);
> +			if (out_data)
> +				avb_slot_verify_data_free(out_data);
>  			return log_msg_ret("avb verify unlocked", -EIO);
>  		}
>  		boot_state = AVB_ORANGE;
> -- 
> 2.47.2