Add error checking for poorly-formed crossystem args

utility/crossystem_main.c

 /* Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * Chrome OS firmware/system interface utility
  */
 
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ skipping 81 matching lines @@
   for (p = sys_param_list; p->name; p++)
     printf("  %-22s  %s\n", p->name, p->desc);
 }
 
 
 /* Find the parameter in the list.
  *
  * Returns the parameter, or NULL if no match. */
 const Param* FindParam(const char* name) {
   const Param* p;
+  if (!name)
+    return NULL;
   for (p = sys_param_list; p->name; p++) {
     if (!strcasecmp(p->name, name))
       return p;
   }
   return NULL;
 }
 
 
 /* Set the specified parameter.
  *
@@ skipping 101 matching lines @@
     return PrintAllParams();
 
   /* Print help if needed */
   if (!strcasecmp(argv[1], "-h") || !strcmp(argv[1], "-?")) {
     PrintHelp(progname);
     return 0;
   }
 
   /* Otherwise, loop through params and get/set them */
   for (i = 1; i < argc && retval == 0; i++) {
-    int has_set = (NULL != strchr(argv[i], '='));
-    int has_expect = (NULL != strchr(argv[i], '?'));
+    char* has_set = strchr(argv[i], '=');
+    char* has_expect = strchr(argv[i], '?');
     char* name = strtok(argv[i], "=?");
     char* value = strtok(NULL, "=?");
-    const Param* p = FindParam(name);
-    if (!p) {
-      fprintf(stderr, "Invalid parameter name: %s\n", name);
+    const Param* p;
+
+    /* Make sure args are well-formed. '' or '=foo' or '?foo' not allowed. */
+    if (!name || has_set == argv[i] || has_expect == argv[i]) {
+      fprintf(stderr, "Poorly formed parameter\n");
       PrintHelp(progname);
       return 1;
     }
+    if (!value)
+      value=""; /* Allow setting/checking an empty string ('foo=' or 'foo?') */
     if (has_set && has_expect) {
       fprintf(stderr, "Use either = or ? in a parameter, but not both.\n");
       PrintHelp(progname);

[petkov, 2011/03/22 00:13:36]

so this is not a warning but an error?

       return 1;
     }
 
+    /* Find the parameter */
+    p = FindParam(name);
+    if (!p) {
+      fprintf(stderr, "Invalid parameter name: %s\n", name);
+      PrintHelp(progname);
+      return 1;
+    }
+
     if (i > 1)
       printf(" ");  /* Output params space-delimited */
     if (has_set)
       retval = SetParam(p, value);
     else if (has_expect)
       retval = CheckParam(p, value);
     else
       retval = PrintParam(p);
   }
 
   return retval;
 }