From b81e716b263479e7e2194f9a2df3c04c83307545 Mon Sep 17 00:00:00 2001 From: Naveen Kumar Chaudhary Date: Fri, 26 Jun 2026 09:18:02 +0530 Subject: [PATCH] cmd: ini: avoid NULL deref when loadaddr/filesize env vars are unset When the user runs "ini
" without explicit address or size arguments, do_ini() falls back to env_get("loadaddr") and env_get("filesize") and passes the results straight to hextoul(). env_get() returns NULL for an undefined variable and hextoul() does not tolerate a NULL pointer, so on a board without these variables set the command dereferences NULL. Fetch the strings into locals first, reject the NULL case with CMD_RET_USAGE, and only then convert to numeric values. Fixes: c167cc02033 ("Add a new "ini" command") Signed-off-by: Naveen Kumar Chaudhary --- cmd/ini.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/cmd/ini.c b/cmd/ini.c index 96399017691..3fe86209c32 100644 --- a/cmd/ini.c +++ b/cmd/ini.c @@ -229,6 +229,7 @@ static int ini_handler(void *user, char *section, char *name, char *value) static int do_ini(struct cmd_tbl *cmdtp, int flag, int argc, char *const argv[]) { const char *section; + const char *addr_str, *size_str; char *file_address; size_t file_size; @@ -236,10 +237,16 @@ static int do_ini(struct cmd_tbl *cmdtp, int flag, int argc, char *const argv[]) return CMD_RET_USAGE; section = argv[1]; - file_address = (char *)hextoul(argc < 3 ? env_get("loadaddr") : argv[2], - NULL); - file_size = (size_t)hextoul(argc < 4 ? env_get("filesize") : argv[3], - NULL); + addr_str = argc < 3 ? env_get("loadaddr") : argv[2]; + size_str = argc < 4 ? env_get("filesize") : argv[3]; + + if (!addr_str || !size_str) { + printf("ini: loadaddr/filesize not set\n"); + return CMD_RET_USAGE; + } + + file_address = (char *)hextoul(addr_str, NULL); + file_size = (size_t)hextoul(size_str, NULL); return ini_parse(file_address, file_size, ini_handler, (void *)section); }