From patchwork Sat Jan 10 20:28:35 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Simon Glass X-Patchwork-Id: 1449 Return-Path: X-Original-To: u-boot-concept@u-boot.org Delivered-To: u-boot-concept@u-boot.org DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=u-boot.org; s=default; t=1768076976; bh=NU63DzlC2dUhgtf9Y8hn22pwdcIL1Y/YIgotydSs35w=; h=From:To:Date:In-Reply-To:References:CC:Subject:List-Id: List-Archive:List-Help:List-Owner:List-Post:List-Subscribe: List-Unsubscribe:From; b=LJNkhiVd0vCulm15+Z+94oD+8PlLdElEkzm2qs52J5RshnBgXUtxsh1rXZcySx9V3 SssQ4UrnJUnycuvi0YopUUOkgRvMthS4SODbzu661IM/zrEQTUa5HqhMtz1M1n8MhY Qz+0T+41vT5zM3cQHc0LsFXGtbd5Gbbm7BZSji6hqG0OZFIqGpHI17UdZPFfkcedAc o1JWzs7KRrVeP9IPA4DISrz/ySdox/psCkjpBAl54uvt3EorPh3rKKLkfOw0y9znPD 2AhbCWxESt6tjuPB1mT6j1A16Uwbjt1/JF3MMjHR/m4cpNnzQTk8L3omP4eoYG6gAB rx++0QSUVj/Jw== Received: from localhost (localhost [127.0.0.1]) by mail.u-boot.org (Postfix) with ESMTP id 2C44569291 for ; Sat, 10 Jan 2026 13:29:36 -0700 (MST) X-Virus-Scanned: Debian amavis at Received: from mail.u-boot.org ([127.0.0.1]) by localhost (mail.u-boot.org [127.0.0.1]) (amavis, port 10024) with ESMTP id A3i-kiTVejUR for ; Sat, 10 Jan 2026 13:29:36 -0700 (MST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=u-boot.org; s=default; t=1768076976; bh=NU63DzlC2dUhgtf9Y8hn22pwdcIL1Y/YIgotydSs35w=; h=From:To:Date:In-Reply-To:References:CC:Subject:List-Id: List-Archive:List-Help:List-Owner:List-Post:List-Subscribe: List-Unsubscribe:From; b=LJNkhiVd0vCulm15+Z+94oD+8PlLdElEkzm2qs52J5RshnBgXUtxsh1rXZcySx9V3 SssQ4UrnJUnycuvi0YopUUOkgRvMthS4SODbzu661IM/zrEQTUa5HqhMtz1M1n8MhY Qz+0T+41vT5zM3cQHc0LsFXGtbd5Gbbm7BZSji6hqG0OZFIqGpHI17UdZPFfkcedAc o1JWzs7KRrVeP9IPA4DISrz/ySdox/psCkjpBAl54uvt3EorPh3rKKLkfOw0y9znPD 2AhbCWxESt6tjuPB1mT6j1A16Uwbjt1/JF3MMjHR/m4cpNnzQTk8L3omP4eoYG6gAB rx++0QSUVj/Jw== Received: from mail.u-boot.org (localhost [127.0.0.1]) by mail.u-boot.org (Postfix) with ESMTP id 1BD0F6928E for ; Sat, 10 Jan 2026 13:29:36 -0700 (MST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=u-boot.org; s=default; t=1768076974; bh=WNUqBkxpq6EzqWkWj2R6kypqGuRhBAthrbgrrAAOy1Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IEgFlHPZmxDBE8K/+VofNiZvjDZlz7ANuCeyHriKQdXxWkuKu7CeMJ6wEcEEbY3Yo PLkedQ39vNoACar0uFhuRZU/uZ410ZJU8W623ATRVxYM9TlLGTw1/Doa98asjor7+0 6HVpLvJj102j3QPdNUPZ0yJzScAuaBgj24g3lMA+dgYUH4zjzZRgO78HBKy+NqmUpz P/hcXSLwWF1BaUjPdutsEJXVWqHI1H9j9D4yRjbFDAPPZSPjdjuykjK9sjg3YnVi7v ZQi64Q5C9pW0VnsXGs62Swzb36+91psjvDCU3xXlxoVV0L0rdQw7NzErlbXj5n+/F0 3Fjm8FDZVidyQ== Received: from localhost (localhost [127.0.0.1]) by mail.u-boot.org (Postfix) with ESMTP id D08826927E; Sat, 10 Jan 2026 13:29:34 -0700 (MST) X-Virus-Scanned: Debian amavis at Received: from mail.u-boot.org ([127.0.0.1]) by localhost (mail.u-boot.org [127.0.0.1]) (amavis, port 10026) with ESMTP id f-sFZejUFf6U; Sat, 10 Jan 2026 13:29:34 -0700 (MST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=u-boot.org; s=default; t=1768076970; bh=MuswaGNNSK1TeA4fn8bkYzLC49X4DbpeNDQvpB/8HSw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=w6W5RzXSZPhFANkpqBlFtsE+ssEo0iQ5yxI6UP/GPKFLkvkgPiW8An6uAD12+2HLE rnxg+umXXMT9v44/1VEIDEaf0CUKqV2N/18eLKlwLrWuJ9NVHWho2Sr5dGF3JmcIKb T9vZu7RJvlGGtQCzCS6cN0JD8DmSDOB5PzpXSexW8SwspwlhUt1AKf4BM74pjEtSid FhN949Jp0rIeO/+LZH7d9GY3MtM5bfuixZvLAdydweAmg9+tuG+gOow6BRgX1Yg6j6 ZP8Gx0FSu7f7jRZRneHk6AnkiAmGCyocv852uEN+hviKQalvojKStsu/gQ4Jx82mr+ RhmTAXf/Fxhsg== Received: from u-boot.org (unknown [73.34.74.121]) by mail.u-boot.org (Postfix) with ESMTPSA id 6D21669186; Sat, 10 Jan 2026 13:29:30 -0700 (MST) From: Simon Glass To: U-Boot Concept Date: Sat, 10 Jan 2026 13:28:35 -0700 Message-ID: <20260110202906.187370-4-sjg@u-boot.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260110202906.187370-1-sjg@u-boot.org> References: <20260110202906.187370-1-sjg@u-boot.org> MIME-Version: 1.0 Message-ID-Hash: SOLHVAMLW7SLWFK3HJHYQ6HXQKC2ZHQS X-Message-ID-Hash: SOLHVAMLW7SLWFK3HJHYQ6HXQKC2ZHQS X-MailFrom: sjg@u-boot.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Heinrich Schuchardt , Simon Glass , "Claude Opus 4 . 5" X-Mailman-Version: 3.3.10 Precedence: list Subject: [Concept] [PATCH 03/26] boot: pxe: Fix token memory leaks in parser List-Id: Discussion and patches related to U-Boot Concept Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Simon Glass The get_token() function allocates memory for t.val when parsing keywords and string literals, but callers do not free this memory. Fix this by: - Initialising t.val to NULL in get_token() so free() is safe for T_EOL/T_EOF tokens which do not allocate - Adding free(t.val) calls in parse_menu(), parse_label_menu(), parse_label(), and parse_pxefile_top() after token processing Co-developed-by: Claude Opus 4.5 Signed-off-by: Simon Glass --- boot/pxe_parse.c | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/boot/pxe_parse.c b/boot/pxe_parse.c index 6d148756b0d..8c720db5e75 100644 --- a/boot/pxe_parse.c +++ b/boot/pxe_parse.c @@ -232,6 +232,7 @@ static void get_token(char **p, struct token *t, enum lex_state state) char *c = *p; t->type = T_INVALID; + t->val = NULL; /* eat non EOL whitespace */ while (isblank(*c)) @@ -418,6 +419,7 @@ static int parse_menu(struct pxe_context *ctx, char **c, struct pxe_menu *cfg, char *s = *c; int err = 0; + t.val = NULL; get_token(c, &t, L_KEYWORD); switch (t.type) { @@ -434,6 +436,7 @@ static int parse_menu(struct pxe_context *ctx, char **c, struct pxe_menu *cfg, printf("Ignoring malformed menu command: %.*s\n", (int)(*c - s), s); } + free(t.val); if (err < 0) return err; @@ -452,6 +455,7 @@ static int parse_label_menu(char **c, struct pxe_menu *cfg, char *s; s = *c; + t.val = NULL; get_token(c, &t, L_KEYWORD); switch (t.type) { @@ -471,6 +475,7 @@ static int parse_label_menu(char **c, struct pxe_menu *cfg, (int)(*c - s), s); } + free(t.val); eol_or_eof(c); return 0; @@ -534,8 +539,10 @@ static int parse_label(char **c, struct pxe_menu *cfg) } list_add_tail(&label->list, &cfg->labels); + t.val = NULL; while (1) { s = *c; + free(t.val); get_token(c, &t, L_KEYWORD); err = 0; @@ -595,8 +602,10 @@ static int parse_label(char **c, struct pxe_menu *cfg) if (p) { label->say = strndup(*c + 1, p - *c - 1); - if (!label->say) + if (!label->say) { + free(t.val); return -ENOMEM; + } *c = p; } break; @@ -608,11 +617,14 @@ static int parse_label(char **c, struct pxe_menu *cfg) * something for the menu level context to handle. */ *c = s; + free(t.val); return 1; } - if (err < 0) + if (err < 0) { + free(t.val); return err; + } } } @@ -637,8 +649,10 @@ int parse_pxefile_top(struct pxe_context *ctx, char *p, ulong base, return -EMLINK; } + t.val = NULL; while (1) { s = p; + free(t.val); get_token(&p, &t, L_KEYWORD); err = 0; @@ -686,6 +700,7 @@ int parse_pxefile_top(struct pxe_context *ctx, char *p, ulong base, case T_EOL: break; case T_EOF: + free(t.val); return 1; default: printf("Ignoring unknown command: %.*s\n", @@ -693,7 +708,9 @@ int parse_pxefile_top(struct pxe_context *ctx, char *p, ulong base, eol_or_eof(&p); } - if (err < 0) + if (err < 0) { + free(t.val); return err; + } } }