...
> commit 2ad6032f294bd603ac31a886a291f0456f5e9635
> Author: Mischa Studer <[email protected]>
> Date:   Wed Feb 24 13:24:51 2021 +0100
> 
>     SegmentationFault: False write-mem pointer to nowhere
>     
>     Commit dunno
>     In flash/nor/cfi.c:835 initialised cfi_info cleared (calloc). As write-mem
>     was uninitialized the pointer pointed to an out of range address, which
>     led to a segmentation fault and crashed openocd. This happened during 
> flash-command
>     of an external flash-bank, using cfi.
>     
>     Change-Id: I0e2ffb90559afe7f090837023428dcc06b2e29f6
>     Signed-off-by: Mischa Studer <[email protected]>
> 
> diff --git a/src/flash/nor/cfi.c b/src/flash/nor/cfi.c
> index 5f5071e..9cf3212 100644
> --- a/src/flash/nor/cfi.c
> +++ b/src/flash/nor/cfi.c
> @@ -832,7 +832,7 @@ int cfi_flash_bank_cmd(struct flash_bank *bank, unsigned 
> int argc, const char **
>               return ERROR_FLASH_BANK_INVALID;
>       }
>  
> -     cfi_info = malloc(sizeof(struct cfi_flash_bank));
> +     cfi_info = calloc(sizeof(struct cfi_flash_bank));
>       cfi_info->probed = false;
>       cfi_info->erase_region_info = NULL;
>       cfi_info->pri_ext = NULL;

This must be a typo, calloc require two args:

 void *calloc(size_t nmemb, size_t size);

you probably mean:

 calloc(1, sizeof(struct cfi_flash_bank));

Then, what about other things in cfi_info, should they also be set to
zero, as a default, as the calloc() does ?
Or should one just be cautios about unitialized values ?

///

Shouldn't the return value of *alloc() be checked ?
Looking through the openocd sources, it seems there is no convention
about this, sometimes it is checked and sometimes not.

Regards,
/Karl Hammar




_______________________________________________
OpenOCD-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openocd-devel

Reply via email to