brain-hackers_pepepper-mirror/u-boot-brain
1
0
Fork 0
mirror of https://github.com/brain-hackers/u-boot-brain synced 2024-06-09 23:36:03 +09:00
Code Issues Projects Releases Wiki Activity

fru: ops: avoid out of bounds access

Browse Source 
Building xilinx_zynq_virt_defconfig fails on origin/next as reported by
GCC 10.2 (as provided by Debian Bullseye):

  CC      board/xilinx/common/fru_ops.o
board/xilinx/common/fru_ops.c: In function ‘fru_capture’:
board/xilinx/common/fru_ops.c:173:8:
error: array subscript 284 is outside array bounds of
‘struct fru_table[1]’ [-Werror=array-bounds]
  173 |  limit = data + sizeof(struct fru_board_data);
      |  ~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
board/xilinx/common/fru_ops.c:17:18: note: while referencing ‘fru_data’
   17 | struct fru_table fru_data __section(.data);
      |                  ^~~~~~~~

When using sizeof(struct fru_board_data) to find the end of the structure
you should add it to the start of the structure.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
This commit is contained in:
Heinrich Schuchardt 2021-01-03 18:07:53 +01:00 committed by Michal Simek
parent 389b45d6b0
commit b6d14c52f9
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
board/xilinx/common/fru_ops.c
View File

@ -170,7 +170,7 @@ static int fru_parse_board(unsigned long addr)
data = (u8 *)&fru_data.brd.manufacturer_type_len;
/* Record max structure limit not to write data over allocated space */
limit = data + sizeof(struct fru_board_data);
limit = (u8 *)&fru_data.brd + sizeof(struct fru_board_data);
for (i = 0; ; i++, data += FRU_BOARD_MAX_LEN) {
len = fru_check_type_len(*(u8 *)addr, fru_data.brd.lang_code,