From d483f93a5ea8340085e5acf149aebec4647372d9 Mon Sep 17 00:00:00 2001
From: CN_SZTL <cnsztl@gmail.com>
Date: Tue, 21 Jan 2020 14:33:54 +0800
Subject: [PATCH] firmware-utils/mksenaofw: fix possible memory leak

---
 tools/firmware-utils/src/dgfirmware.c        |  6 ++++
 tools/firmware-utils/src/dns313-header.c     |  3 ++
 tools/firmware-utils/src/mkchkimg.c          |  8 +++++
 tools/firmware-utils/src/mkfwimage.c         | 21 +++++++++++
 tools/firmware-utils/src/mkfwimage2.c        |  3 ++
 tools/firmware-utils/src/mksenaofw.c         |  2 ++
 tools/firmware-utils/src/mktitanimg.c        |  1 +
 tools/firmware-utils/src/mktplinkfw.c        |  6 ++++
 tools/firmware-utils/src/tplink-safeloader.c | 38 +++++++++++++++++++-
 9 files changed, 87 insertions(+), 1 deletion(-)

diff --git a/tools/firmware-utils/src/dgfirmware.c b/tools/firmware-utils/src/dgfirmware.c
index e3257f1077..3ec4712ec9 100644
--- a/tools/firmware-utils/src/dgfirmware.c
+++ b/tools/firmware-utils/src/dgfirmware.c
@@ -86,6 +86,8 @@ void write_img(unsigned char* img, const char *fname)
     fclose(fp);
     exit(-1);
   }
+
+  fclose(fp);
 }
 
 
@@ -104,6 +106,8 @@ void write_rootfs(unsigned char* img, const char *fname)
     fclose(fp);
     exit(-1);
   }
+
+  fclose(fp);
 }
 
 
@@ -122,6 +126,8 @@ void write_kernel(unsigned char* img, const char *fname)
     fclose(fp);
     exit(-1);
   }
+
+  fclose(fp);
 }
 
 
diff --git a/tools/firmware-utils/src/dns313-header.c b/tools/firmware-utils/src/dns313-header.c
index e69e57e7ba..3c72b09bfb 100644
--- a/tools/firmware-utils/src/dns313-header.c
+++ b/tools/firmware-utils/src/dns313-header.c
@@ -168,11 +168,14 @@ int main(int argc, char **argv)
 	fdin = open(pathin, O_RDONLY);
 	if (!fdin) {
 		printf("ERROR: could not open input file\n");
+		free(buffer);
 		return 0;
 	}
 	bytes = read(fdin, buffer + HEADER_SIZE, filesize);
 	if (bytes < filesize) {
 		printf("ERROR: could not read entire file\n");
+		free(buffer);
+		close(fdin);
 		return 0;
 	}
 	close(fdin);
diff --git a/tools/firmware-utils/src/mkchkimg.c b/tools/firmware-utils/src/mkchkimg.c
index 0fe01f0707..5f2823f154 100644
--- a/tools/firmware-utils/src/mkchkimg.c
+++ b/tools/firmware-utils/src/mkchkimg.c
@@ -231,6 +231,7 @@ main (int argc, char * argv[])
 	if (fs_file) {
 		fs_fp = fopen (fs_file, "r");
 		if (!fs_fp) {
+			fclose(kern_fp);
 			fatal_error (errno, "Cannot open %s", fs_file);
 		}
 	}
@@ -238,6 +239,10 @@ main (int argc, char * argv[])
 	/* Open the output file */
 	out_fp = fopen (output_file, "w+");
 	if (!out_fp) {
+		fclose(kern_fp);
+		if (fs_fp) {
+			fclose(fs_fp);
+		}
 		fatal_error (errno, "Cannot open %s", output_file);
 	}
 
@@ -285,6 +290,7 @@ main (int argc, char * argv[])
 		netgear_checksum_add (&chk_part, (unsigned char *)buf, len);
 		netgear_checksum_add (&chk_whole, (unsigned char *)buf, len);
 	}
+	fclose(kern_fp);
 	hdr->kernel_chksum = netgear_checksum_fini (&chk_part);
 	message ("     Kernel Len: %u", hdr->kernel_len);
 	message ("Kernel Checksum: 0x%08x", hdr->kernel_chksum);
@@ -306,6 +312,7 @@ main (int argc, char * argv[])
 			netgear_checksum_add (&chk_part, (unsigned char *)buf, len);
 			netgear_checksum_add (&chk_whole, (unsigned char *)buf, len);
 		}
+		fclose(fs_fp);
 		hdr->rootfs_chksum = (netgear_checksum_fini (&chk_part));
 		message ("     Rootfs Len: %u", hdr->rootfs_len);
 		message ("Rootfs Checksum: 0x%08x", hdr->rootfs_chksum);
@@ -336,6 +343,7 @@ main (int argc, char * argv[])
 	}
 
 	/* Success */
+	fclose(out_fp);
 	return EXIT_SUCCESS;
 }
 
diff --git a/tools/firmware-utils/src/mkfwimage.c b/tools/firmware-utils/src/mkfwimage.c
index c8737386a2..9e6d8f5b9a 100644
--- a/tools/firmware-utils/src/mkfwimage.c
+++ b/tools/firmware-utils/src/mkfwimage.c
@@ -110,6 +110,15 @@ struct fw_info fw_info[] = {
 		},
 		.sign = false,
 	},
+	{
+		.name = "SW",
+		.fw_layout = {
+			.kern_start	=	0x9f050000,
+			.kern_entry	=	0x80002000,
+			.firmware_max_length=	0x00760000,
+		},
+		.sign = false,
+	},
 	{
 		.name = "UBDEV01",
 		.fw_layout = {
@@ -128,6 +137,15 @@ struct fw_info fw_info[] = {
 		},
 		.sign = true,
 	},
+	{
+		.name = "ACB-ISP",
+		.fw_layout = {
+			.kern_start	=	0x9f050000,
+			.kern_entry	=	0x80002000,
+			.firmware_max_length=	0x00F60000,
+		},
+		.sign = true,
+	},
 	{
 		.name = "",
 	},
@@ -437,6 +455,7 @@ static int build_image(image_info_t* im)
 	if ((f = fopen(im->outputfile, "w")) == NULL)
 	{
 		ERROR("Can not create output file: '%s'\n", im->outputfile);
+		free(mem);
 		return -10;
 	}
 
@@ -444,6 +463,8 @@ static int build_image(image_info_t* im)
 	{
 		ERROR("Could not write %d bytes into file: '%s'\n",
 				mem_size, im->outputfile);
+		free(mem);
+		fclose(f);
 		return -11;
 	}
 
diff --git a/tools/firmware-utils/src/mkfwimage2.c b/tools/firmware-utils/src/mkfwimage2.c
index 89a98051b4..9b7e1a3cd7 100644
--- a/tools/firmware-utils/src/mkfwimage2.c
+++ b/tools/firmware-utils/src/mkfwimage2.c
@@ -363,12 +363,15 @@ static int build_image(void)
 	/* write in-memory buffer into file */
 	if ((f = fopen(im.outputfile, "w")) == NULL) {
 		ERROR("Can not create output file: '%s'\n", im.outputfile);
+		free(mem);
 		return -10;
 	}
 
 	if (fwrite(mem, mem_size, 1, f) != 1) {
 		ERROR("Could not write %d bytes into file: '%s'\n",
 				mem_size, im.outputfile);
+		free(mem);
+		fclose(f);
 		return -11;
 	}
 
diff --git a/tools/firmware-utils/src/mksenaofw.c b/tools/firmware-utils/src/mksenaofw.c
index b0fb7203c3..d9ccfbc1e0 100644
--- a/tools/firmware-utils/src/mksenaofw.c
+++ b/tools/firmware-utils/src/mksenaofw.c
@@ -316,10 +316,12 @@ int decode_image(const char *input_file_name, const char *output_file_name)
 			if (fread(pmodel, 1, cw_header.model_size, fp_input) !=
 				  cw_header.model_size) {
 				fprintf(stderr, "Incorrect header size reading model name!!");
+				free(pmodel);
 				fclose(fp_input);
 				fclose(fp_output);
 				return -1;
 			}
+			free(pmodel);
 		} else {
 			fprintf(stderr, "Incorrect header size reading model name!!");
 			fclose(fp_input);
diff --git a/tools/firmware-utils/src/mktitanimg.c b/tools/firmware-utils/src/mktitanimg.c
index cca4a0ebae..120d08f0c4 100644
--- a/tools/firmware-utils/src/mktitanimg.c
+++ b/tools/firmware-utils/src/mktitanimg.c
@@ -225,6 +225,7 @@ int main(int argc, char* argv[], char* env[])
 			if(fwrite((void*)buf,1,padding,nsp_image)!=padding) {
 				printf("ERROR: can't write to %s.\n", filen_out);
 				free(buf);
+				fclose(nsp_image);
 				return -1;
 			}
 			free(buf);
diff --git a/tools/firmware-utils/src/mktplinkfw.c b/tools/firmware-utils/src/mktplinkfw.c
index ce2acc20c9..ed785b48e5 100644
--- a/tools/firmware-utils/src/mktplinkfw.c
+++ b/tools/firmware-utils/src/mktplinkfw.c
@@ -144,6 +144,12 @@ static struct flash_layout layouts[] = {
 		.kernel_la	= 0x80060000,
 		.kernel_ep	= 0x80060000,
 		.rootfs_ofs	= 0x100000,
+	}, {
+		.id		= "8Mmtk",
+		.fw_max_len	= 0x7c0000,
+		.kernel_la	= 0x80000000,
+		.kernel_ep	= 0x8000c310,
+		.rootfs_ofs	= 0x100000,
 	}, {
 		.id		= "16M",
 		.fw_max_len	= 0xf80000,
diff --git a/tools/firmware-utils/src/tplink-safeloader.c b/tools/firmware-utils/src/tplink-safeloader.c
index 29ffae80ff..8749597617 100644
--- a/tools/firmware-utils/src/tplink-safeloader.c
+++ b/tools/firmware-utils/src/tplink-safeloader.c
@@ -891,7 +891,7 @@ static struct device_info boards[] = {
 			"{product_name:Archer C6,product_ver:2.0.0,special_id:52550000}\r\n"
 			"{product_name:Archer C6,product_ver:2.0.0,special_id:4A500000}\r\n",
 		.support_trail = '\x00',
-		.soft_ver = "soft_ver:1.0.0\n",
+		.soft_ver = "soft_ver:1.1.1\n",
 
 		.partitions = {
 			{"fs-uboot", 0x00000, 0x20000},
@@ -1437,6 +1437,42 @@ static struct device_info boards[] = {
 		.last_sysupgrade_partition = "file-system",
 	},
 
+  /** Firmware layout for the RE305 v1 */
+	{
+		.id     = "RE305-V1",
+		.vendor = "",
+		.support_list =
+			"SupportList:\n"
+			"{product_name:RE305,product_ver:1.0.0,special_id:45550000}\n"
+			"{product_name:RE305,product_ver:1.0.0,special_id:55530000}\n"
+			"{product_name:RE305,product_ver:1.0.0,special_id:4a500000}\n"
+			"{product_name:RE305,product_ver:1.0.0,special_id:42520000}\n"
+			"{product_name:RE305,product_ver:1.0.0,special_id:4b520000}\n"
+			"{product_name:RE305,product_ver:1.0.0,special_id:41550000}\n"
+			"{product_name:RE305,product_ver:1.0.0,special_id:43410000}\n",
+		.support_trail = '\x00',
+		.soft_ver = NULL,
+
+		.partitions = {
+			{"fs-uboot", 0x00000, 0x20000},
+			{"firmware", 0x20000, 0x5e0000},
+			{"partition-table", 0x600000, 0x02000},
+			{"default-mac", 0x610000, 0x00020},
+			{"pin", 0x610100, 0x00020},
+			{"product-info", 0x611100, 0x01000},
+			{"soft-version", 0x620000, 0x01000},
+			{"support-list", 0x621000, 0x01000},
+			{"profile", 0x622000, 0x08000},
+			{"user-config", 0x630000, 0x10000},
+			{"default-config", 0x640000, 0x10000},
+			{"radio", 0x7f0000, 0x10000},
+			{NULL, 0, 0}
+		},
+
+		.first_sysupgrade_partition = "os-image",
+		.last_sysupgrade_partition = "file-system"
+	},
+
 	/** Firmware layout for the RE350 v1 */
 	{
 		.id     = "RE350-V1",