espressif/esp-idf
1
0
Fork 1
mirror of https://github.com/espressif/esp-idf.git synced 2025-08-06 22:24:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'bugfix/oom_null_deref' into 'master'

Browse Source 
spi_flash, newlib: fix NULL pointer dereference on OOM

Closes IDF-2788 and IDF-2789

See merge request espressif/esp-idf!17489
This commit is contained in:
Anton Maklakov
2022-03-15 09:24:43 +08:00
parent b044bc4509 4aa2719e13
commit 7efbca6701
2 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
components/newlib/newlib_init.c
View File

@@ -139,6 +139,10 @@ void esp_newlib_init(void)
_GLOBAL_REENT = &s_reent; _GLOBAL_REENT = &s_reent;
environ = malloc(sizeof(char*)); environ = malloc(sizeof(char*));
if (environ == 0) {
// if allocation fails this early in startup process, there's nothing else other than to panic.
abort();
}
environ[0] = NULL; environ[0] = NULL;
esp_newlib_locks_init(); esp_newlib_locks_init();

6
components/spi_flash/partition.c
View File

@@ -234,6 +234,9 @@ static esp_partition_iterator_opaque_t *iterator_create(esp_partition_type_t typ
{ {
esp_partition_iterator_opaque_t *it = esp_partition_iterator_opaque_t *it =
(esp_partition_iterator_opaque_t *) malloc(sizeof(esp_partition_iterator_opaque_t)); (esp_partition_iterator_opaque_t *) malloc(sizeof(esp_partition_iterator_opaque_t));
if (it == NULL) {
return NULL;
}
it->type = type; it->type = type;
it->subtype = subtype; it->subtype = subtype;
it->label = label; it->label = label;
@@ -256,6 +259,9 @@ esp_partition_iterator_t esp_partition_find(esp_partition_type_t type,
// create an iterator pointing to the start of the list // create an iterator pointing to the start of the list
// (next item will be the first one) // (next item will be the first one)
esp_partition_iterator_t it = iterator_create(type, subtype, label); esp_partition_iterator_t it = iterator_create(type, subtype, label);
if (it == NULL) {
return NULL;
}
// advance iterator to the next item which matches constraints // advance iterator to the next item which matches constraints
it = esp_partition_next(it); it = esp_partition_next(it);
// if nothing found, it == NULL and iterator has been released // if nothing found, it == NULL and iterator has been released