[openwrt/openwrt] mtd: check the return value of malloc and pread

[LEDE Commits]

robimarko pushed a commit to openwrt/openwrt.git, branch openwrt-24.10:
https://git.openwrt.org/082608fd2bc29dc2d9a7d4d7dc3463d72e2989f6

commit 082608fd2bc29dc2d9a7d4d7dc3463d72e2989f6
Author: Qiyuan Zhang <zhang.github at outlook.com>
AuthorDate: Mon Aug 5 06:47:21 2024 -0400

    mtd: check the return value of malloc and pread
    
    Check the return value of malloc and pread in case they fail.
    
    Signed-off-by: Qiyuan Zhang <zhang.github at outlook.com>
    Link: https://github.com/openwrt/openwrt/pull/16070
    (cherry picked from commit 3f014543cd4bd099dc089cbb9b9b2d7b0db8a021)
    Signed-off-by: Rafal Boni <rafal.boni at gmail.com>
    Link: https://github.com/openwrt/openwrt/pull/17889
    Signed-off-by: Robert Marko <robimarko at gmail.com>
---
 package/system/mtd/src/linksys_bootcount.c | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/package/system/mtd/src/linksys_bootcount.c b/package/system/mtd/src/linksys_bootcount.c
index d22486203e..3ec0b61718 100644
--- a/package/system/mtd/src/linksys_bootcount.c
+++ b/package/system/mtd/src/linksys_bootcount.c
@@ -106,17 +106,31 @@ int mtd_resetbc(const char *mtd)
 	}
 
 	num_bc = mtd_info.size / bc_offset_increment;
-        curr = malloc(bc_offset_increment);
+	curr = malloc(bc_offset_increment);
+
+	if(curr == NULL) {
+		DLOG_ERR("Failed to allocate %u bytes from memory.", bc_offset_increment);
+
+		retval = -6;
+		goto out;
+	}
 
 	for (i = 0; i < num_bc; i++) {
-		pread(fd, curr, sizeof(struct bootcounter), i * bc_offset_increment);
+		ret = pread(fd, curr, sizeof(struct bootcounter), i * bc_offset_increment);
+
+		if(ret != sizeof(struct bootcounter)) {
+			DLOG_ERR("Failed to read boot-count log at offset 0x%08x.", i * bc_offset_increment);
+
+			retval = -5;
+			goto out;
+		}
 
 		/* Existing code assumes erase is to 0xff; left as-is (2019) */
 		if (curr->magic == 0xffffffff)
 			break;
 
 		if (curr->magic != BOOTCOUNT_MAGIC || curr->checksum != curr->magic + curr->count) {
-			DLOG_ERR("Unexpected boot-count log at offset %08x: magic %08x boot count %08x checksum %08x; aborting.",
+			DLOG_ERR("Unexpected boot-count log at offset 0x%08x: magic 0x%08x boot count 0x%08x checksum 0x%08x; aborting.",
 				 i * bc_offset_increment, curr->magic, curr->count, curr->checksum);
 
 			retval = -2;
@@ -179,7 +193,9 @@ int mtd_resetbc(const char *mtd)
 	}
 
 out:
-	if (curr != NULL) free(curr);
+	if (curr != NULL)
+		free(curr);
+
 	close(fd);
 	return retval;
 }