Commit b237d358b "moveconfig: expand simple expressions" added support for expanding expressions in configs, but used the unsafe python built-in "eval". This patch fixes this by replacing eval with the asteval module.
Signed-off-by: Markus Klotzbuecher <[email protected]> Cc: Heinrich Schuchardt <[email protected]> Cc: Heiko Schocher <[email protected]> Cc: Tom Rini <[email protected]> Cc: Simon Glass <[email protected]> Cc: Joe Hershberger <[email protected]> Cc: Masahiro Yamada <[email protected]> --- tools/moveconfig.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tools/moveconfig.py b/tools/moveconfig.py index 36160a3977..df20ec66af 100755 --- a/tools/moveconfig.py +++ b/tools/moveconfig.py @@ -295,6 +295,7 @@ To see the complete list of supported options, run """ +import asteval import collections import copy import difflib @@ -808,10 +809,11 @@ def try_expand(line): return line try: + aeval = asteval.Interpreter( usersyms=SIZES, minimal=True ) cfg, val = re.split("=", line) val= val.strip('\"') if re.search("[*+-/]|<<|SZ_+|\(([^\)]+)\)", val): - newval = hex(eval(val, SIZES)) + newval = hex(aeval(val)) print("\tExpanded expression %s to %s" % (val, newval)) return cfg+'='+newval except: -- 2.25.0
