[PATCH 1/2] tools/thermal/thermometer: Fix missing NULL check after realloc()

From: YanLong Dai

Date: Tue Nov 03 2026 - 09:02:32 EST


In configuration_default_init(), the return value of realloc() is
assigned directly to config->tz_regex without checking for NULL. If
realloc() fails, the original pointer is lost (memory leak) and
subsequent dereference causes a NULL pointer crash.

Fix by using a temporary variable to receive the realloc() result and
checking for NULL before assigning to config->tz_regex.

Fixes: 110acbc6a451 ("tools/thermal: Add a temperature capture tool")
Signed-off-by: YanLong Dai <daiyanlong@xxxxxxxxxx>
---
tools/thermal/thermometer/thermometer.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/tools/thermal/thermometer/thermometer.c b/tools/thermal/thermometer/thermometer.c
index 1ae6c3ecedb4..b4f26d49e4c7 100644
--- a/tools/thermal/thermometer/thermometer.c
+++ b/tools/thermal/thermometer/thermometer.c
@@ -83,8 +83,15 @@ static struct tz_regex *configuration_tz_match(const char *expr,

static int configuration_default_init(struct configuration *config)
{
- config->tz_regex = realloc(config->tz_regex, sizeof(*config->tz_regex) *
- (config->nr_tz_regex + 1));
+ struct tz_regex *tmp;
+
+ tmp = realloc(config->tz_regex, sizeof(*config->tz_regex) *
+ (config->nr_tz_regex + 1));
+ if (!tmp) {
+ ERROR("Failed to allocate memory for thermal zone regex\n");
+ return -1;
+ }
+ config->tz_regex = tmp;

if (regcomp(&config->tz_regex[config->nr_tz_regex].regex, ".*",
REG_NOSUB | REG_EXTENDED)) {
--
2.25.1