The records read from the stash are copied to data->record +
data->rec_count, but the loop that assigns their name pointers iterated
starting at data->record + data->next_id. These offsets only coincide
when both are zero; with a non-zero next_id (e.g. after a 'first' init,
where next_id is BOOTSTAGE_ID_USER) the names are written into the wrong
records or past the end of the array.
Iterate from data->record + data->rec_count so the name fix-up matches
the records that were actually copied.
Fixes: 03ecac31498 ("bootstage: Use rec_count as the array index")
Signed-off-by: Naveen Kumar Chaudhary <[email protected]>
---
common/bootstage.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/common/bootstage.c b/common/bootstage.c
index 4532100acea..f3f4f7b66e4 100644
--- a/common/bootstage.c
+++ b/common/bootstage.c
@@ -478,7 +478,7 @@ int bootstage_unstash(const void *base, int size)
/* Read the name strings */
ptr += rec_size;
- for (rec = data->record + data->next_id, i = 0; i < hdr->count;
+ for (rec = data->record + data->rec_count, i = 0; i < hdr->count;
i++, rec++) {
rec->name = ptr;
if (xpl_phase() == PHASE_SPL)
--
2.43.0
