diff options
| author | Joe Moore <awokd@danwin1210.me> | 2019-10-21 03:32:38 -0600 |
|---|---|---|
| committer | Nico Huber <nico.h@gmx.de> | 2020-01-13 11:22:40 +0000 |
| commit | 159cd3f42144c196e19d7d497085b51d0f4cd52c (patch) | |
| tree | 38ab65d17c3613371cc9ff487d6b140724513004 | |
| parent | 04e49425ec1f1aaccf4695ab01d0f0181d5923ae (diff) | |
| download | coreboot-159cd3f42144c196e19d7d497085b51d0f4cd52c.tar.xz | |
vc/amd/agesa: Fix out of bounds read
ByteLane is used unitialized from prior for statement,
creating a potential out-of-bound read of RxOrig[MaxByteLanes].
PassTestRxEnDly[MaxByteLanes] never appears as rvalue; all for
loops have ByteLane < MaxByteLanes exit condition.
Change-Id: Icd18a146aba6b6120d37518d8c40c7efbc05afa3
Signed-off-by: Joe Moore <awokd@danwin1210.me>
Found-by: Coverity CID 1241804
Reviewed-on: https://review.coreboot.org/c/coreboot/+/36192
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Mike Banon <mikebdp2@gmail.com>
| -rw-r--r-- | src/vendorcode/amd/agesa/f15tn/Proc/Mem/Tech/mtthrcSeedTrain.c | 2 | ||||
| -rw-r--r-- | src/vendorcode/amd/agesa/f16kb/Proc/Mem/Tech/mtthrcSeedTrain.c | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/src/vendorcode/amd/agesa/f15tn/Proc/Mem/Tech/mtthrcSeedTrain.c b/src/vendorcode/amd/agesa/f15tn/Proc/Mem/Tech/mtthrcSeedTrain.c index 3406d76306..991667bca2 100644 --- a/src/vendorcode/amd/agesa/f15tn/Proc/Mem/Tech/mtthrcSeedTrain.c +++ b/src/vendorcode/amd/agesa/f15tn/Proc/Mem/Tech/mtthrcSeedTrain.c @@ -313,7 +313,6 @@ MemTRdPosWithRxEnDlySeeds3 ( // IDS_HDT_CONSOLE (MEM_FLOW, "\n\t\t Setting PassTestRxEnDly\n"); IDS_HDT_CONSOLE (MEM_FLOW, "\t PassTestRxEnDly: "); - PassTestRxEnDly[ByteLane] = RxOrig[ByteLane]; for (ByteLane = 0; ByteLane < MaxByteLanes; ByteLane++) { if (RxEnDlyTargetFound[ByteLane] == FALSE) { // Calculate "PassTestRxEnDly" from current "RxEnDly" @@ -328,6 +327,7 @@ MemTRdPosWithRxEnDlySeeds3 ( MemTRdPosRxEnSeedSetDly3 (TechPtr, PassTestRxEnDly[ByteLane], ByteLane); OutOfRange[ByteLane] = FALSE; } else { + PassTestRxEnDly[ByteLane] = RxOrig[ByteLane]; OutOfRange[ByteLane] = TRUE; } } else { diff --git a/src/vendorcode/amd/agesa/f16kb/Proc/Mem/Tech/mtthrcSeedTrain.c b/src/vendorcode/amd/agesa/f16kb/Proc/Mem/Tech/mtthrcSeedTrain.c index ce295acc80..1446f3e009 100644 --- a/src/vendorcode/amd/agesa/f16kb/Proc/Mem/Tech/mtthrcSeedTrain.c +++ b/src/vendorcode/amd/agesa/f16kb/Proc/Mem/Tech/mtthrcSeedTrain.c @@ -314,7 +314,6 @@ MemTRdPosWithRxEnDlySeeds3 ( // IDS_HDT_CONSOLE (MEM_FLOW, "\n\t\t Setting PassTestRxEnDly\n"); IDS_HDT_CONSOLE (MEM_FLOW, "\t PassTestRxEnDly: "); - PassTestRxEnDly[ByteLane] = RxOrig[ByteLane]; for (ByteLane = 0; ByteLane < MaxByteLanes; ByteLane++) { if (RxEnDlyTargetFound[ByteLane] == FALSE) { // Calculate "PassTestRxEnDly" from current "RxEnDly" @@ -329,6 +328,7 @@ MemTRdPosWithRxEnDlySeeds3 ( MemTRdPosRxEnSeedSetDly3 (TechPtr, PassTestRxEnDly[ByteLane], ByteLane); OutOfRange[ByteLane] = FALSE; } else { + PassTestRxEnDly[ByteLane] = RxOrig[ByteLane]; OutOfRange[ByteLane] = TRUE; } } else { |