diff options
| author | Rasmus Villemoes <rasmus.villemoes@prevas.dk> | 2023-03-24 08:55:19 +0100 |
|---|---|---|
| committer | Patrice Chotard <patrice.chotard@foss.st.com> | 2023-04-19 10:02:28 +0200 |
| commit | daf07215e8c4aed16af81e1615396f5502040c1f (patch) | |
| tree | bc6f4a5b69b81b1761c2751511defabd97feb28a | |
| parent | bb0352009822239044ac7f2eafcdff8c71d56ed2 (diff) | |
| download | u-boot-daf07215e8c4aed16af81e1615396f5502040c1f.zip u-boot-daf07215e8c4aed16af81e1615396f5502040c1f.tar.gz u-boot-daf07215e8c4aed16af81e1615396f5502040c1f.tar.bz2 | |
stm32mp: fix various array bounds checks
In all these cases, the index on the LHS is immediately afterwards
used to access the array appearing in the ARRAY_SIZE() on the RHS - so
if that index is equal to the array size, we'll access
one-past-the-end of the array.
Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
Reviewed-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
| -rw-r--r-- | arch/arm/mach-stm32mp/cpu.c | 4 | ||||
| -rw-r--r-- | board/st/stm32mp1/stm32mp1.c | 2 | ||||
| -rw-r--r-- | drivers/ram/stm32mp1/stm32mp1_interactive.c | 2 |
3 files changed, 4 insertions, 4 deletions
diff --git a/arch/arm/mach-stm32mp/cpu.c b/arch/arm/mach-stm32mp/cpu.c index dc4112d..e2f67fc 100644 --- a/arch/arm/mach-stm32mp/cpu.c +++ b/arch/arm/mach-stm32mp/cpu.c @@ -190,7 +190,7 @@ static void setup_boot_mode(void) __func__, boot_ctx, boot_mode, instance, forced_mode); switch (boot_mode & TAMP_BOOT_DEVICE_MASK) { case BOOT_SERIAL_UART: - if (instance > ARRAY_SIZE(serial_addr)) + if (instance >= ARRAY_SIZE(serial_addr)) break; /* serial : search associated node in devicetree */ sprintf(cmd, "serial@%x", serial_addr[instance]); @@ -220,7 +220,7 @@ static void setup_boot_mode(void) break; case BOOT_FLASH_SD: case BOOT_FLASH_EMMC: - if (instance > ARRAY_SIZE(sdmmc_addr)) + if (instance >= ARRAY_SIZE(sdmmc_addr)) break; /* search associated sdmmc node in devicetree */ sprintf(cmd, "mmc@%x", sdmmc_addr[instance]); diff --git a/board/st/stm32mp1/stm32mp1.c b/board/st/stm32mp1/stm32mp1.c index ca8f025..1a1b184 100644 --- a/board/st/stm32mp1/stm32mp1.c +++ b/board/st/stm32mp1/stm32mp1.c @@ -872,7 +872,7 @@ int mmc_get_boot(void) STM32_SDMMC3_BASE }; - if (instance > ARRAY_SIZE(sdmmc_addr)) + if (instance >= ARRAY_SIZE(sdmmc_addr)) return 0; /* search associated sdmmc node in devicetree */ diff --git a/drivers/ram/stm32mp1/stm32mp1_interactive.c b/drivers/ram/stm32mp1/stm32mp1_interactive.c index f0fe7e6..2c19847 100644 --- a/drivers/ram/stm32mp1/stm32mp1_interactive.c +++ b/drivers/ram/stm32mp1/stm32mp1_interactive.c @@ -391,7 +391,7 @@ bool stm32mp1_ddr_interactive(void *priv, if (next_step < 0) return false; - if (step < 0 || step > ARRAY_SIZE(step_str)) { + if (step < 0 || step >= ARRAY_SIZE(step_str)) { printf("** step %d ** INVALID\n", step); return false; } |