dtc: Fix NULL pointer use in dtlabel + dtref case

If we have a construct like this: label: &handle { ... }; Running dtc on it will cause a segfault, because we use 'target' when it could be NULL. Move the add_label() call into the if statement to fix this potentially bad use of a NULL pointer. Signed-off-by: Stephen Boyd <[email protected]> Signed-off-by: David Gibson <[email protected]>
robherring · Jan 30, 2017 · 3b9c970 · 3b9c970
1 parent 43eb551
commit 3b9c970
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 3 deletions.
diff --git a/dtc-parser.y b/dtc-parser.y
@@ -171,10 +171,10 @@ devicetree:
 		{
 			struct node *target = get_node_by_ref($1, $3);
 
-			add_label(&target->labels, $2);
-			if (target)
+			if (target) {
+				add_label(&target->labels, $2);
 				merge_nodes(target, $4);
-			else
+			} else
 				ERROR(&@3, "Label or path %s not found", $3);
 			$$ = $1;
 		}

diff --git a/tests/run_tests.sh b/tests/run_tests.sh
@@ -511,6 +511,7 @@ dtc_tests () {
     run_test dtbs_equal_ordered multilabel.test.dtb multilabel_merge.test.dtb
     run_dtc_test -I dts -O dtb -o dtc_tree1_merge_path.test.dtb test_tree1_merge_path.dts
     tree1_tests dtc_tree1_merge_path.test.dtb test_tree1.dtb
+    run_wrap_error_test $DTC -I dts -O dtb -o /dev/null test_label_ref.dts
 
     # Check prop/node delete functionality
     run_dtc_test -I dts -O dtb -o dtc_tree1_delete.test.dtb test_tree1_delete.dts

diff --git a/tests/test_label_ref.dts b/tests/test_label_ref.dts
@@ -0,0 +1,9 @@
+/dts-v1/;
+
+/ {
+
+};
+
+label: &handle {
+
+};