From 408cab5f9d940950977f2ba86efa385ad880c702 Mon Sep 17 00:00:00 2001 From: Francois Berder Date: Sat, 9 May 2026 21:20:18 +0200 Subject: [PATCH] board: nxp: Fix OOB read in ft_board_setup base and size arrays can both contain up to total_memory_banks elements. This commit fixes the for loop condition to ensure that it does not attempt to read past the end of both arrays. Signed-off-by: Francois Berder Signed-off-by: Peng Fan --- board/nxp/ls1088a/ls1088a.c | 2 +- board/nxp/ls2080ardb/ls2080ardb.c | 2 +- board/nxp/lx2160a/lx2160a.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/board/nxp/ls1088a/ls1088a.c b/board/nxp/ls1088a/ls1088a.c index 51ec055be63..5783dd8a403 100644 --- a/board/nxp/ls1088a/ls1088a.c +++ b/board/nxp/ls1088a/ls1088a.c @@ -974,7 +974,7 @@ int ft_board_setup(void *blob, struct bd_info *bd) #endif if (mc_memory_base != 0) { - for (i = 0; i <= total_memory_banks; i++) { + for (i = 0; i < total_memory_banks; i++) { if (base[i] == 0 && size[i] == 0) { base[i] = mc_memory_base; size[i] = mc_memory_size; diff --git a/board/nxp/ls2080ardb/ls2080ardb.c b/board/nxp/ls2080ardb/ls2080ardb.c index 6f824f57c47..d08598d1c62 100644 --- a/board/nxp/ls2080ardb/ls2080ardb.c +++ b/board/nxp/ls2080ardb/ls2080ardb.c @@ -503,7 +503,7 @@ int ft_board_setup(void *blob, struct bd_info *bd) #endif if (mc_memory_base != 0) { - for (i = 0; i <= total_memory_banks; i++) { + for (i = 0; i < total_memory_banks; i++) { if (base[i] == 0 && size[i] == 0) { base[i] = mc_memory_base; size[i] = mc_memory_size; diff --git a/board/nxp/lx2160a/lx2160a.c b/board/nxp/lx2160a/lx2160a.c index 341f82ce724..d34865de8c2 100644 --- a/board/nxp/lx2160a/lx2160a.c +++ b/board/nxp/lx2160a/lx2160a.c @@ -818,7 +818,7 @@ int ft_board_setup(void *blob, struct bd_info *bd) #endif if (mc_memory_base != 0) { - for (i = 0; i <= total_memory_banks; i++) { + for (i = 0; i < total_memory_banks; i++) { if (base[i] == 0 && size[i] == 0) { base[i] = mc_memory_base; size[i] = mc_memory_size;