The code to choose the filename to use does not cope with no name set at all. Firstly the test for a name in net_boot_file_name tests the pointer rather than the string it points to. Secondly the cleanup on exit in this case attempts to free a global variable. Fix both issues.
Signed-off-by: Andrew Goodbody <[email protected]> --- net/lwip/tftp.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/lwip/tftp.c b/net/lwip/tftp.c index 94bacf630752d20357cef40775a25cca39d811dc..6c7ffba661e5903b6b3a6349edf2c8b22eb0d36b 100644 --- a/net/lwip/tftp.c +++ b/net/lwip/tftp.c @@ -279,7 +279,7 @@ int do_tftpb(struct cmd_tbl *cmdtp, int flag, int argc, char *const argv[]) if (!arg) arg = net_boot_file_name; - if (arg) { + if (*arg) { /* Parse [ip:[port:]]fname */ i = 0; while ((*(words + i) = strsep(&arg, ":"))) @@ -342,6 +342,7 @@ int do_tftpb(struct cmd_tbl *cmdtp, int flag, int argc, char *const argv[]) if (tftp_loop(eth_get_dev(), laddr, fname, srvip, port) < 0) ret = CMD_RET_FAILURE; out: - free(arg); + if (arg != net_boot_file_name) + free(arg); return ret; } --- base-commit: 59f9fcc1f514762674ac07c13c2a85f7aace7250 change-id: 20251205-lwip_fixes-ea4051356612 Best regards, -- Andrew Goodbody <[email protected]>
