[PATCH] cmd: efidebug: require the URI argument of 'boot add -u'

[PATCH] cmd: efidebug: require the URI argument of 'boot add -u'

[Yuho Choi]

efi_boot_add_uri() is called with argv[0] pointing to "-u" and reads
the boot option id, the label and the URI from argv[1] to argv[3], but
it only requires argc >= 3. When the URI is left out, as in

  efidebug boot add -u 1 label

argv[3] is the NULL pointer that terminates the argument list. It is
passed to wget_validate_uri(), which dereferences it in strchr(). On
sandbox the command crashes with a segmentation fault.

Require four arguments, so that a missing URI is reported as a usage
error.

Fixes: f01c961ee34c ("cmd: efidebug: add uri device path")
Signed-off-by: Yuho Choi <oss.patchbox@gmail.com>
---
Tested on sandbox_defconfig with EFI_HTTP_BOOT=y: without this patch
'efidebug boot add -u 1 NoUri' crashes with a segmentation fault; with
it the command prints the usage and returns 1.
'efidebug boot add -u 7 Uri http://1.2.3.4/a.efi' still creates
Boot0007 with the URI device path.

 cmd/efidebug.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cmd/efidebug.c b/cmd/efidebug.c
index f7329156038..09d14ffd3b4 100644
--- a/cmd/efidebug.c
+++ b/cmd/efidebug.c
@@ -742,7 +742,7 @@ static int efi_boot_add_uri(int argc, char *const argv[], u16 *var_name16,
 	efi_uintn_t uridp_len;
 	struct efi_device_path_uri *uridp;
 
-	if (argc < 3 || lo->label)
+	if (argc < 4 || lo->label)
 		return CMD_RET_USAGE;
 
 	id = (int)hextoul(argv[1], &endp);
-- 
2.43.0