bootspec: fix null-dereference-read

yuwata · lnykryn · commit f3b4ad802dd4 · 2024-05-14T12:50:40.000+02:00
Fixes [oss-fuzz#53578](https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53578). Fixes #25450. (cherry picked from commit 46dc071) Resolves: RHEL-36284
diff --git a/src/shared/bootspec.c b/src/shared/bootspec.c
@@ -996,6 +996,8 @@ static int boot_config_find(const BootConfig *config, const char *id) {
         if (id[0] == '@') {
                 if (!strcaseeq(id, "@saved"))
                         return -1;
+                if (!config->entry_selected)
+                        return -1;
                 id = config->entry_selected;
         }
 
diff --git a/test/fuzz/fuzz-bootspec/clusterfuzz-testcase-minimized-fuzz-bootspec-5731869371269120 b/test/fuzz/fuzz-bootspec/clusterfuzz-testcase-minimized-fuzz-bootspec-5731869371269120
@@ -0,0 +1 @@
+{"config":"default @saved","loader":[""]}

Original file line number	Diff line number	Diff line change
`@@ -996,6 +996,8 @@ static int boot_config_find(const BootConfig config, const char id) {`
`996`	`996`	`if (id[0] == '@') {`
`997`	`997`	`if (!strcaseeq(id, "@saved"))`
`998`	`998`	`return -1;`
	`999`	`+ if (!config->entry_selected)`
	`1000`	`+ return -1;`
`999`	`1001`	`id = config->entry_selected;`
`1000`	`1002`	`}`
`1001`	`1003`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+{"config":"default @saved","loader":[""]}`