diff options
| author | Jacob Garber <jgarber1@ualberta.ca> | 2019-03-29 18:33:32 -0600 |
|---|---|---|
| committer | Patrick Georgi <pgeorgi@google.com> | 2019-04-08 14:13:39 +0000 |
| commit | 0decccb666245e38bfd0595e8c7e312c6937c465 (patch) | |
| tree | ae8d2c6e7ba4bd15518051ae472ac78807459cab /src/soc/intel/baytrail | |
| parent | 42660cdda7020ab7056f219e9033c9d0f2f09239 (diff) | |
| download | coreboot-0decccb666245e38bfd0595e8c7e312c6937c465.tar.xz | |
soc/intel/baytrail: Correct array bounds check
If `gms == ARRAY_SIZE(gms_size_map)`, then we will have an
out of bounds read. Fix the check to exclude this case.
This was partially fixed in 04f68c1 (baytrail: fix range
check).
Found-by: Coverity Scan, CID 1229677 (OVERRUN)
Signed-off-by: Jacob Garber <jgarber1@ualberta.ca>
Change-Id: I8c8cd59df49beea066b46cde3cf00237816aff33
Reviewed-on: https://review.coreboot.org/c/coreboot/+/32125
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net>
Reviewed-by: Patrick Georgi <pgeorgi@google.com>
Diffstat (limited to 'src/soc/intel/baytrail')
| -rw-r--r-- | src/soc/intel/baytrail/gfx.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/soc/intel/baytrail/gfx.c b/src/soc/intel/baytrail/gfx.c index 5d6d504a86..d2cb589db8 100644 --- a/src/soc/intel/baytrail/gfx.c +++ b/src/soc/intel/baytrail/gfx.c @@ -48,7 +48,7 @@ static void gfx_lock_pcbase(struct device *dev) gms = pci_read_config32(dev, GGC) & GGC_GSM_SIZE_MASK; gms >>= 3; - if (gms > ARRAY_SIZE(gms_size_map)) + if (gms >= ARRAY_SIZE(gms_size_map)) return; gmsize = gms_size_map[gms]; |