summaryrefslogtreecommitdiff
path: root/src/vendorcode/amd
diff options
context:
space:
mode:
authorJoe Moore <awokd@danwin1210.me>2019-10-21 03:32:38 -0600
committerNico Huber <nico.h@gmx.de>2020-01-13 11:22:40 +0000
commit159cd3f42144c196e19d7d497085b51d0f4cd52c (patch)
tree38ab65d17c3613371cc9ff487d6b140724513004 /src/vendorcode/amd
parent04e49425ec1f1aaccf4695ab01d0f0181d5923ae (diff)
downloadcoreboot-159cd3f42144c196e19d7d497085b51d0f4cd52c.tar.xz
vc/amd/agesa: Fix out of bounds read
ByteLane is used unitialized from prior for statement, creating a potential out-of-bound read of RxOrig[MaxByteLanes]. PassTestRxEnDly[MaxByteLanes] never appears as rvalue; all for loops have ByteLane < MaxByteLanes exit condition. Change-Id: Icd18a146aba6b6120d37518d8c40c7efbc05afa3 Signed-off-by: Joe Moore <awokd@danwin1210.me> Found-by: Coverity CID 1241804 Reviewed-on: https://review.coreboot.org/c/coreboot/+/36192 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Mike Banon <mikebdp2@gmail.com>
Diffstat (limited to 'src/vendorcode/amd')
-rw-r--r--src/vendorcode/amd/agesa/f15tn/Proc/Mem/Tech/mtthrcSeedTrain.c2
-rw-r--r--src/vendorcode/amd/agesa/f16kb/Proc/Mem/Tech/mtthrcSeedTrain.c2
2 files changed, 2 insertions, 2 deletions
diff --git a/src/vendorcode/amd/agesa/f15tn/Proc/Mem/Tech/mtthrcSeedTrain.c b/src/vendorcode/amd/agesa/f15tn/Proc/Mem/Tech/mtthrcSeedTrain.c
index 3406d76306..991667bca2 100644
--- a/src/vendorcode/amd/agesa/f15tn/Proc/Mem/Tech/mtthrcSeedTrain.c
+++ b/src/vendorcode/amd/agesa/f15tn/Proc/Mem/Tech/mtthrcSeedTrain.c
@@ -313,7 +313,6 @@ MemTRdPosWithRxEnDlySeeds3 (
//
IDS_HDT_CONSOLE (MEM_FLOW, "\n\t\t Setting PassTestRxEnDly\n");
IDS_HDT_CONSOLE (MEM_FLOW, "\t PassTestRxEnDly: ");
- PassTestRxEnDly[ByteLane] = RxOrig[ByteLane];
for (ByteLane = 0; ByteLane < MaxByteLanes; ByteLane++) {
if (RxEnDlyTargetFound[ByteLane] == FALSE) {
// Calculate "PassTestRxEnDly" from current "RxEnDly"
@@ -328,6 +327,7 @@ MemTRdPosWithRxEnDlySeeds3 (
MemTRdPosRxEnSeedSetDly3 (TechPtr, PassTestRxEnDly[ByteLane], ByteLane);
OutOfRange[ByteLane] = FALSE;
} else {
+ PassTestRxEnDly[ByteLane] = RxOrig[ByteLane];
OutOfRange[ByteLane] = TRUE;
}
} else {
diff --git a/src/vendorcode/amd/agesa/f16kb/Proc/Mem/Tech/mtthrcSeedTrain.c b/src/vendorcode/amd/agesa/f16kb/Proc/Mem/Tech/mtthrcSeedTrain.c
index ce295acc80..1446f3e009 100644
--- a/src/vendorcode/amd/agesa/f16kb/Proc/Mem/Tech/mtthrcSeedTrain.c
+++ b/src/vendorcode/amd/agesa/f16kb/Proc/Mem/Tech/mtthrcSeedTrain.c
@@ -314,7 +314,6 @@ MemTRdPosWithRxEnDlySeeds3 (
//
IDS_HDT_CONSOLE (MEM_FLOW, "\n\t\t Setting PassTestRxEnDly\n");
IDS_HDT_CONSOLE (MEM_FLOW, "\t PassTestRxEnDly: ");
- PassTestRxEnDly[ByteLane] = RxOrig[ByteLane];
for (ByteLane = 0; ByteLane < MaxByteLanes; ByteLane++) {
if (RxEnDlyTargetFound[ByteLane] == FALSE) {
// Calculate "PassTestRxEnDly" from current "RxEnDly"
@@ -329,6 +328,7 @@ MemTRdPosWithRxEnDlySeeds3 (
MemTRdPosRxEnSeedSetDly3 (TechPtr, PassTestRxEnDly[ByteLane], ByteLane);
OutOfRange[ByteLane] = FALSE;
} else {
+ PassTestRxEnDly[ByteLane] = RxOrig[ByteLane];
OutOfRange[ByteLane] = TRUE;
}
} else {