[PATCH v1 4/7] bootstd: cros: Clear bootmeth_priv after freeing it on error

cros_read_bootflow() stores priv in bflow->bootmeth_priv and then
calls cros_read_info(). If that fails, priv is freed but
bflow->bootmeth_priv keeps pointing at the freed memory.

With 'bootflow scan -a', failed bootflows are stored in the bootstd
list, so the stale pointer is kept and bootflow_free() later frees it
a second time, corrupting the heap. This is the same problem recently
fixed in the RAUC bootmeth.

Clear bflow->bootmeth_priv after freeing, as bootmeth_android already
does.

Fixes: 71f634b822ae ("bootstd: cros: Allow detection of any kernel partition")
Signed-off-by: Aristo Chen <[email protected]>
---
 boot/bootmeth_cros.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/boot/bootmeth_cros.c b/boot/bootmeth_cros.c
index c7b862e512a..f894ed78e3a 100644
--- a/boot/bootmeth_cros.c
+++ b/boot/bootmeth_cros.c
@@ -405,6 +405,7 @@ static int cros_read_bootflow(struct udevice *dev, struct bootflow *bflow)
 	if (ret) {
 		free(priv->info_buf);
 		free(priv);
+		bflow->bootmeth_priv = NULL;
 		return log_msg_ret("inf", ret);
 	}
 	bflow->size = priv->body_size;
-- 
2.43.0