소스 검색

spi_flash, newlib: fix NULL pointer dereference on OOM

https://pvs-studio.com/en/blog/posts/cpp/0790/#ID88049D3FA2
Reported in https://github.com/espressif/esp-idf/issues/6440
Ivan Grokhotkov 3 년 전
부모
커밋
4aa2719e13
2개의 변경된 파일10개의 추가작업 그리고 0개의 파일을 삭제
  1. 4 0
      components/newlib/newlib_init.c
  2. 6 0
      components/spi_flash/partition.c

+ 4 - 0
components/newlib/newlib_init.c

@@ -139,6 +139,10 @@ void esp_newlib_init(void)
     _GLOBAL_REENT = &s_reent;
 
     environ = malloc(sizeof(char*));
+    if (environ == 0) {
+        // if allocation fails this early in startup process, there's nothing else other than to panic.
+        abort();
+    }
     environ[0] = NULL;
 
     esp_newlib_locks_init();

+ 6 - 0
components/spi_flash/partition.c

@@ -234,6 +234,9 @@ static esp_partition_iterator_opaque_t *iterator_create(esp_partition_type_t typ
 {
     esp_partition_iterator_opaque_t *it =
         (esp_partition_iterator_opaque_t *) malloc(sizeof(esp_partition_iterator_opaque_t));
+    if (it == NULL) {
+        return NULL;
+    }
     it->type = type;
     it->subtype = subtype;
     it->label = label;
@@ -256,6 +259,9 @@ esp_partition_iterator_t esp_partition_find(esp_partition_type_t type,
     // create an iterator pointing to the start of the list
     // (next item will be the first one)
     esp_partition_iterator_t it = iterator_create(type, subtype, label);
+    if (it == NULL) {
+        return NULL;
+    }
     // advance iterator to the next item which matches constraints
     it = esp_partition_next(it);
     // if nothing found, it == NULL and iterator has been released