When use_fallback is set and the config defines a fallback label,
parse_pxefile() assigns fallback_label to default_label. The previous
default_label allocation is not freed, so that string is leaked. Both
members then point at the same buffer, and destroy_pxe_menu() frees it
twice.
Free the previous default_label and clear fallback_label so only one
member owns the string.
Fixes: 8ba82a91b3aa ("boot: Add logic to enable booting from fallback option")
Signed-off-by: Suraj Kakade <[email protected]>
---
boot/pxe_utils.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/boot/pxe_utils.c b/boot/pxe_utils.c
index 8c1310dabeb..9841c426267 100644
--- a/boot/pxe_utils.c
+++ b/boot/pxe_utils.c
@@ -1529,7 +1529,9 @@ struct pxe_menu *parse_pxefile(struct pxe_context *ctx,
unsigned long menucfg)
if (ctx->use_fallback) {
if (cfg->fallback_label) {
printf("Setting use of fallback\n");
+ free(cfg->default_label);
cfg->default_label = cfg->fallback_label;
+ cfg->fallback_label = NULL;
} else {
printf("Selected fallback option, but not set\n");
}
--
2.43.7
