diff options
| author | Jacob Garber <jgarber1@ualberta.ca> | 2019-04-08 17:54:35 -0600 |
|---|---|---|
| committer | Patrick Georgi <pgeorgi@google.com> | 2019-04-11 11:27:41 +0000 |
| commit | f74f6cbde5b51bb85fa3b20b80f482ef41eb7e9b (patch) | |
| tree | f86bee2e4a97d56ec764f48244e9a3240db56b5c | |
| parent | 94d61ecab035fbef7e93db8cfbdbabd7c41a264d (diff) | |
| download | coreboot-f74f6cbde5b51bb85fa3b20b80f482ef41eb7e9b.tar.xz | |
nb/intel/{gm45,i945,x4x}: Correct array bounds checks
There will be an out of bounds read if the index is equal
to the array size. Fix the checks to exclude this case.
Found-by: Coverity Scan, CID 1347350, 1347351
Signed-off-by: Jacob Garber <jgarber1@ualberta.ca>
Change-Id: I5b4e8febb68dfd244faf597dfe5cdf509af7a2ae
Reviewed-on: https://review.coreboot.org/c/coreboot/+/32244
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Patrick Georgi <pgeorgi@google.com>
| -rw-r--r-- | src/northbridge/intel/gm45/ram_calc.c | 2 | ||||
| -rw-r--r-- | src/northbridge/intel/i945/ram_calc.c | 2 | ||||
| -rw-r--r-- | src/northbridge/intel/x4x/ram_calc.c | 4 |
3 files changed, 4 insertions, 4 deletions
diff --git a/src/northbridge/intel/gm45/ram_calc.c b/src/northbridge/intel/gm45/ram_calc.c index c72055fb3a..c1307c48f5 100644 --- a/src/northbridge/intel/gm45/ram_calc.c +++ b/src/northbridge/intel/gm45/ram_calc.c @@ -39,7 +39,7 @@ u32 decode_igd_memory_size(const u32 gms) static const u16 ggc2uma[] = { 0, 1, 4, 8, 16, 32, 48, 64, 128, 256, 96, 160, 224, 352 }; - if (gms > ARRAY_SIZE(ggc2uma)) + if (gms >= ARRAY_SIZE(ggc2uma)) die("Bad Graphics Mode Select (GMS) setting.\n"); return ggc2uma[gms] << 10; diff --git a/src/northbridge/intel/i945/ram_calc.c b/src/northbridge/intel/i945/ram_calc.c index 124a6a8317..752c8f901c 100644 --- a/src/northbridge/intel/i945/ram_calc.c +++ b/src/northbridge/intel/i945/ram_calc.c @@ -82,7 +82,7 @@ u32 decode_igd_memory_size(const u32 gms) static const u16 ggc2uma[] = { 0, 1, 4, 8, 16, 32, 48, 64 }; - if (gms > ARRAY_SIZE(ggc2uma)) + if (gms >= ARRAY_SIZE(ggc2uma)) die("Bad Graphics Mode Select (GMS) setting.\n"); return ggc2uma[gms] << 10; diff --git a/src/northbridge/intel/x4x/ram_calc.c b/src/northbridge/intel/x4x/ram_calc.c index 8f9d739aea..371496985f 100644 --- a/src/northbridge/intel/x4x/ram_calc.c +++ b/src/northbridge/intel/x4x/ram_calc.c @@ -36,7 +36,7 @@ u32 decode_igd_memory_size(const u32 gms) static const u16 ggc2uma[] = { 0, 1, 4, 8, 16, 32, 48, 64, 128, 256, 96, 160, 224, 352 }; - if (gms > ARRAY_SIZE(ggc2uma)) + if (gms >= ARRAY_SIZE(ggc2uma)) die("Bad Graphics Mode Select (GMS) setting.\n"); return ggc2uma[gms] << 10; @@ -47,7 +47,7 @@ u32 decode_igd_gtt_size(const u32 gsm) { static const u8 ggc2gtt[] = { 0, 1, 0, 2, 0, 0, 0, 0, 0, 2, 3, 4}; - if (gsm > ARRAY_SIZE(ggc2gtt)) + if (gsm >= ARRAY_SIZE(ggc2gtt)) die("Bad GTT Graphics Memory Size (GGMS) setting.\n"); return ggc2gtt[gsm] << 10; |