Bootstage records may legitimately have a NULL name (for example an id turned into an accumulator via bootstage_accum() without a preceding bootstage_start(), whose record is zero-initialised). bootstage_relocate() called strcpy() on rec->name and bootstage_get_size() called strlen() on it directly, both dereferencing NULL and crashing during relocation.
Skip records with no name in both functions. They are handled identically so the size reported by bootstage_get_size(true) still matches the bytes written by bootstage_relocate(). Signed-off-by: Naveen Kumar Chaudhary <[email protected]> --- common/bootstage.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/common/bootstage.c b/common/bootstage.c index 4532100acea..4b1e5b91743 100644 --- a/common/bootstage.c +++ b/common/bootstage.c @@ -75,6 +75,8 @@ int bootstage_relocate(void *to) for (i = 0; i < data->rec_count; i++) { const char *from = data->record[i].name; + if (!from) + continue; strcpy(ptr, from); data->record[i].name = ptr; ptr += strlen(ptr) + 1; @@ -523,7 +525,8 @@ int bootstage_get_size(bool add_strings) int i; for (rec = data->record, i = 0; i < data->rec_count; i++, rec++) - size += strlen(rec->name) + 1; + if (rec->name) + size += strlen(rec->name) + 1; } return size; -- 2.43.0
