sravan/system76-coreboot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

libpayload: Fix potential NULL pointer dereference

Browse Source 
Found-by: Klockwork
BUG=NONE
TEST=Boot to OS on GLK Sparky

Signed-off-by: Francois Toguo <francois.toguo.fotso@intel.com>
Change-Id: I9d4636f0429de829e746909492c2f543026a02ac
Reviewed-on: https://review.coreboot.org/c/coreboot/+/32083
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Lijian Zhao <lijian.zhao@intel.com>
Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net>
Reviewed-by: Patrick Georgi <pgeorgi@google.com>
This commit is contained in:
Francois Toguo
2019-03-27 10:30:20 -07:00
committed by Patrick Georgi
parent e0c181d487
commit 651d8dd4f6
3 changed files with 44 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
payloads/libpayload/drivers/usb/uhci.c
View File

@@ -317,6 +317,8 @@ uhci_control (usbdev_t *dev, direction_t dir, int drlen, void *devreq, int dalen
unsigned short req = ((unsigned short *) devreq)[0];
int i;
td_t *tds = memalign (16, sizeof (td_t) * count);
if (!tds)
fatal("Not enough memory for uhci control.\n");
memset (tds, 0, sizeof (td_t) * count);
count--; /* to compensate for 0-indexed array */
for (i = 0; i < count; i++) {
@@ -386,6 +388,8 @@ create_schedule (int numpackets)
if (numpackets == 0)
return 0;
td_t *tds = memalign (16, sizeof (td_t) * numpackets);
if (!tds)
fatal("Not enough memory for packets scheduling.\n");
memset (tds, 0, sizeof (td_t) * numpackets);
int i;
for (i = 0; i < numpackets; i++) {