From mboxrd@z Thu Jan  1 00:00:00 1970
From: Markus Klotzbuecher <mk@mkio.de>
Date: Wed, 12 Feb 2020 20:46:44 +0100
Subject: [PATCH 1/2] moveconfig: replace unsafe eval with asteval
In-Reply-To: <20200212194645.1765445-1-mk@mkio.de>
References: <20200212194645.1765445-1-mk@mkio.de>
Message-ID: <20200212194645.1765445-2-mk@mkio.de>
List-Id: <u-boot.lists.denx.de>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
To: u-boot@lists.denx.de

Commit b237d358b "moveconfig: expand simple expressions" added support
for expanding expressions in configs, but used the unsafe python
built-in "eval". This patch fixes this by replacing eval with the
asteval module.

Signed-off-by: Markus Klotzbuecher <mk@mkio.de>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Heiko Schocher <hs@denx.de>
Cc: Tom Rini <trini@konsulko.com>
Cc: Simon Glass <sjg@chromium.org>
Cc: Joe Hershberger <joe.hershberger@ni.com>
Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
---
 tools/moveconfig.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tools/moveconfig.py b/tools/moveconfig.py
index 36160a3977..df20ec66af 100755
--- a/tools/moveconfig.py
+++ b/tools/moveconfig.py
@@ -295,6 +295,7 @@ To see the complete list of supported options, run
 
 """
 
+import asteval
 import collections
 import copy
 import difflib
@@ -808,10 +809,11 @@ def try_expand(line):
         return line
 
     try:
+        aeval = asteval.Interpreter( usersyms=SIZES, minimal=True )
         cfg, val = re.split("=", line)
         val= val.strip('\"')
         if re.search("[*+-/]|<<|SZ_+|\(([^\)]+)\)", val):
-            newval = hex(eval(val, SIZES))
+            newval = hex(aeval(val))
             print("\tExpanded expression %s to %s" % (val, newval))
             return cfg+'='+newval
     except:
-- 
2.25.0