Hi Frieder,
On 2026-10-29T16:23:07+11:00, Frieder Schrempf <[email protected]> wrote:
> bootstd: rauc: Fix leak of the active slot name
>
> find_active_slot() returns a strdup() copy of the slot name, which
> distro_rauc_boot() never frees, so every boot attempt leaks it. The
> strdup() result is not checked either and if it fails, get_slot() passes
> NULL to strcmp().
>
> Check the strdup() result and free the copy right after looking up
> the slot. Use the name of the slot from then on.
>
> Fixes: 7e5c2c782fb9 ("bootstd: Add implementation for bootmeth rauc")
> Assisted-by: LLM
> Signed-off-by: Frieder Schrempf <[email protected]>
>
> boot/bootmeth_rauc.c | 19 ++++++++++++-------
> 1 file changed, 12 insertions(+), 7 deletions(-)
> diff --git a/boot/bootmeth_rauc.c b/boot/bootmeth_rauc.c
> @@ -347,6 +347,10 @@ static int find_active_slot(char **slot_name, ulong
> *slot_tries)
> return log_msg_ret("env", ret);
> }
> *slot_name = strdup(boot_order_list[i]);
> + if (!*slot_name) {
> + str_free_list(boot_order_list);
> + return log_msg_ret("buf", -ENOMEM);
> + }
The caller only uses the copy to call get_slot(), then frees it. You
could pass priv to find_active_slot() and do the get_slot() lookup
there, while boot_order_list is still valid, then return a const
struct distro_rauc_slot * instead of the name. That removes the
strdup(), the new -ENOMEM path and the free() in the caller. It also
means a BOOT_ORDER entry with no matching slot is caught before its
BOOT_x_LEFT counter is decremented. What do you think?
Regards,
Simon
