On Thu, 13 Aug 2026 15:56:10 +0000, Aristo Chen via U-Boot wrote:
> This series fixes a crash and several memory-safety problems in the
> bootstd scan and boot error paths, most of them in the RAUC bootmeth.
>
> The starting point is a NULL pointer dereference in the RAUC bootmeth's
> get_slot(): its loop condition dereferences each slots[] entry before
> checking it against the NULL terminator, so a BOOT_ORDER environment
> variable naming a slot that is not configured in
> CONFIG_BOOTMETH_RAUC_PARTITIONS crashes U-Boot. BOOT_ORDER is written by
> the OS (RAUC) into an often disk-resident environment, so a stray or
> corrupted value must not crash the bootloader (patch 1).
>
> [...]
Applied to u-boot/next, thanks!
[1/7] bootstd: rauc: Fix NULL dereference in get_slot()
commit: 7cf8ccaf7614e16aa4d57620e61179e73907ab6e
[2/7] bootstd: rauc: Clear bootmeth_priv after freeing it on error
commit: 22100a6520671c357a28ffd25d5736abba77b427
[3/7] bootstd: rauc: Free string lists on error paths
commit: d8b381ae3fe8804f6e90016684adc55d4244c3ff
[4/7] bootstd: cros: Clear bootmeth_priv after freeing it on error
commit: 2fb0b1da6780bc0e6e24c600eb1e8738160aa049
[5/7] bootstd: rauc: Fix leak of the strsep() source buffers
commit: 36381cef22bd9ef943821fb94b15f43bc287a513
[6/7] bootstd: Free abandoned bootflows while scanning
commit: ad1fa724f82e201c870b90c0822fb5b90d8eec5b
[7/7] bootstd: rauc: Clear bootmeth_priv after freeing it when booting
commit: f2bdbe5080a6da3222cc753e24e0c23c807ff9d3
--
Tom
