sravan/system76-coreboot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

vc/amd/agesa: Fix out of bounds read

Browse Source 
ByteLane is used unitialized from prior for statement,
creating a potential out-of-bound read of RxOrig[MaxByteLanes].
PassTestRxEnDly[MaxByteLanes] never appears as rvalue; all for
loops have ByteLane < MaxByteLanes exit condition.

Change-Id: Icd18a146aba6b6120d37518d8c40c7efbc05afa3
Signed-off-by: Joe Moore <awokd@danwin1210.me>
Found-by: Coverity CID 1241804
Reviewed-on: https://review.coreboot.org/c/coreboot/+/36192
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Mike Banon <mikebdp2@gmail.com>
This commit is contained in:
Joe Moore
2019-10-21 03:32:38 -06:00
committed by Nico Huber
parent 04e49425ec
commit 159cd3f421
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/vendorcode/amd/agesa/f15tn/Proc/Mem/Tech/mtthrcSeedTrain.c
View File

@@ -313,7 +313,6 @@ MemTRdPosWithRxEnDlySeeds3 (
// //
IDS_HDT_CONSOLE (MEM_FLOW, "\n\t\t Setting PassTestRxEnDly\n"); IDS_HDT_CONSOLE (MEM_FLOW, "\n\t\t Setting PassTestRxEnDly\n");
IDS_HDT_CONSOLE (MEM_FLOW, "\t PassTestRxEnDly: "); IDS_HDT_CONSOLE (MEM_FLOW, "\t PassTestRxEnDly: ");
PassTestRxEnDly[ByteLane] = RxOrig[ByteLane];
for (ByteLane = 0; ByteLane < MaxByteLanes; ByteLane++) { for (ByteLane = 0; ByteLane < MaxByteLanes; ByteLane++) {
if (RxEnDlyTargetFound[ByteLane] == FALSE) { if (RxEnDlyTargetFound[ByteLane] == FALSE) {
// Calculate "PassTestRxEnDly" from current "RxEnDly" // Calculate "PassTestRxEnDly" from current "RxEnDly"
@@ -328,6 +327,7 @@ MemTRdPosWithRxEnDlySeeds3 (
MemTRdPosRxEnSeedSetDly3 (TechPtr, PassTestRxEnDly[ByteLane], ByteLane); MemTRdPosRxEnSeedSetDly3 (TechPtr, PassTestRxEnDly[ByteLane], ByteLane);
OutOfRange[ByteLane] = FALSE; OutOfRange[ByteLane] = FALSE;
} else { } else {
PassTestRxEnDly[ByteLane] = RxOrig[ByteLane];
OutOfRange[ByteLane] = TRUE; OutOfRange[ByteLane] = TRUE;
} }
} else { } else {

2
src/vendorcode/amd/agesa/f16kb/Proc/Mem/Tech/mtthrcSeedTrain.c
View File

@@ -314,7 +314,6 @@ MemTRdPosWithRxEnDlySeeds3 (
// //
IDS_HDT_CONSOLE (MEM_FLOW, "\n\t\t Setting PassTestRxEnDly\n"); IDS_HDT_CONSOLE (MEM_FLOW, "\n\t\t Setting PassTestRxEnDly\n");
IDS_HDT_CONSOLE (MEM_FLOW, "\t PassTestRxEnDly: "); IDS_HDT_CONSOLE (MEM_FLOW, "\t PassTestRxEnDly: ");
PassTestRxEnDly[ByteLane] = RxOrig[ByteLane];
for (ByteLane = 0; ByteLane < MaxByteLanes; ByteLane++) { for (ByteLane = 0; ByteLane < MaxByteLanes; ByteLane++) {
if (RxEnDlyTargetFound[ByteLane] == FALSE) { if (RxEnDlyTargetFound[ByteLane] == FALSE) {
// Calculate "PassTestRxEnDly" from current "RxEnDly" // Calculate "PassTestRxEnDly" from current "RxEnDly"
@@ -329,6 +328,7 @@ MemTRdPosWithRxEnDlySeeds3 (
MemTRdPosRxEnSeedSetDly3 (TechPtr, PassTestRxEnDly[ByteLane], ByteLane); MemTRdPosRxEnSeedSetDly3 (TechPtr, PassTestRxEnDly[ByteLane], ByteLane);
OutOfRange[ByteLane] = FALSE; OutOfRange[ByteLane] = FALSE;
} else { } else {
PassTestRxEnDly[ByteLane] = RxOrig[ByteLane];
OutOfRange[ByteLane] = TRUE; OutOfRange[ByteLane] = TRUE;
} }
} else { } else {