diff options
| author | Heinrich Schuchardt <xypron.glpk@gmx.de> | 2021-01-03 18:07:53 +0100 |
|---|---|---|
| committer | Michal Simek <michal.simek@xilinx.com> | 2021-01-05 11:54:53 +0100 |
| commit | b6d14c52f91b57367e7bd8499c963b74fb74b41e (patch) | |
| tree | 9eb54307708e727cb05ff587a608b5186022009d /board | |
| parent | 389b45d6b05784c0043bac859666b98a5f704402 (diff) | |
| download | u-boot-b6d14c52f91b57367e7bd8499c963b74fb74b41e.zip u-boot-b6d14c52f91b57367e7bd8499c963b74fb74b41e.tar.gz u-boot-b6d14c52f91b57367e7bd8499c963b74fb74b41e.tar.bz2 | |
fru: ops: avoid out of bounds access
Building xilinx_zynq_virt_defconfig fails on origin/next as reported by
GCC 10.2 (as provided by Debian Bullseye):
CC board/xilinx/common/fru_ops.o
board/xilinx/common/fru_ops.c: In function ‘fru_capture’:
board/xilinx/common/fru_ops.c:173:8:
error: array subscript 284 is outside array bounds of
‘struct fru_table[1]’ [-Werror=array-bounds]
173 | limit = data + sizeof(struct fru_board_data);
| ~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
board/xilinx/common/fru_ops.c:17:18: note: while referencing ‘fru_data’
17 | struct fru_table fru_data __section(.data);
| ^~~~~~~~
When using sizeof(struct fru_board_data) to find the end of the structure
you should add it to the start of the structure.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Diffstat (limited to 'board')
| -rw-r--r-- | board/xilinx/common/fru_ops.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/board/xilinx/common/fru_ops.c b/board/xilinx/common/fru_ops.c index b4cd3d4..44f0913 100644 --- a/board/xilinx/common/fru_ops.c +++ b/board/xilinx/common/fru_ops.c @@ -170,7 +170,7 @@ static int fru_parse_board(unsigned long addr) data = (u8 *)&fru_data.brd.manufacturer_type_len; /* Record max structure limit not to write data over allocated space */ - limit = data + sizeof(struct fru_board_data); + limit = (u8 *)&fru_data.brd + sizeof(struct fru_board_data); for (i = 0; ; i++, data += FRU_BOARD_MAX_LEN) { len = fru_check_type_len(*(u8 *)addr, fru_data.brd.lang_code, |