vhaudiquet/u-boot-krane
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

board: nxp: Fix OOB read in ft_board_setup

Browse Source 
base and size arrays can both contain up to total_memory_banks
elements.
This commit fixes the for loop condition to ensure that it does
not attempt to read past the end of both arrays.

Signed-off-by: Francois Berder <fberder@outlook.fr>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
This commit is contained in:
Francois Berder
2026-05-15 19:28:31 +08:00
committed by Peng Fan
parent 9a621ea635
commit 408cab5f9d
3 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
board/nxp/ls1088a/ls1088a.c
+1 -1
View File
@@ -974,7 +974,7 @@ int ft_board_setup(void *blob, struct bd_info *bd)
#endif
if (mc_memory_base != 0) {
for (i = 0; i <= total_memory_banks; i++) {
for (i = 0; i < total_memory_banks; i++) {
if (base[i] == 0 && size[i] == 0) {
base[i] = mc_memory_base;
size[i] = mc_memory_size;
board/nxp/ls2080ardb/ls2080ardb.c
+1 -1
View File
@@ -503,7 +503,7 @@ int ft_board_setup(void *blob, struct bd_info *bd)
#endif
if (mc_memory_base != 0) {
for (i = 0; i <= total_memory_banks; i++) {
for (i = 0; i < total_memory_banks; i++) {
if (base[i] == 0 && size[i] == 0) {
base[i] = mc_memory_base;
size[i] = mc_memory_size;
board/nxp/lx2160a/lx2160a.c
+1 -1
View File
@@ -818,7 +818,7 @@ int ft_board_setup(void *blob, struct bd_info *bd)
#endif
if (mc_memory_base != 0) {
for (i = 0; i <= total_memory_banks; i++) {
for (i = 0; i < total_memory_banks; i++) {
if (base[i] == 0 && size[i] == 0) {
base[i] = mc_memory_base;
size[i] = mc_memory_size;