bootstage_mark_code() allocated the label buffer without checking the result and then dereferenced it, risking a NULL pointer crash on allocation failure. The length calculation also failed to account for the "," and ": " separators emitted by the snprintf() calls, so the assembled string could be silently truncated. Additionally, when file and func are NULL and linenum is -1, the buffer was passed on uninitialized.
Account for the separator bytes, bail out on allocation failure, and ensure the buffer is always NUL-terminated. Signed-off-by: Naveen Kumar Chaudhary <[email protected]> --- common/bootstage.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/common/bootstage.c b/common/bootstage.c index 4532100acea..9e1a8609148 100644 --- a/common/bootstage.c +++ b/common/bootstage.c @@ -175,12 +175,15 @@ ulong bootstage_mark_code(const char *file, const char *func, int linenum) if (linenum != -1) len = 11; if (func) - len += strlen(func); + len += strlen(func) + 2; /* ": " separator */ if (file) - len += strlen(file); + len += strlen(file) + 1; /* "," separator */ str = malloc(len + 1); + if (!str) + return timer_get_boot_us(); p = str; + *p = '\0'; end = p + len; if (file) p += snprintf(p, end - p, "%s,", file); -- 2.43.0
