From 651d8dd4f6562e1176d87b7dfe7210507a622f55 Mon Sep 17 00:00:00 2001 From: Francois Toguo Date: Wed, 27 Mar 2019 10:30:20 -0700 Subject: libpayload: Fix potential NULL pointer dereference Found-by: Klockwork BUG=NONE TEST=Boot to OS on GLK Sparky Signed-off-by: Francois Toguo Change-Id: I9d4636f0429de829e746909492c2f543026a02ac Reviewed-on: https://review.coreboot.org/c/coreboot/+/32083 Tested-by: build bot (Jenkins) Reviewed-by: Lijian Zhao Reviewed-by: Paul Menzel Reviewed-by: Patrick Georgi --- payloads/libpayload/drivers/usb/uhci.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'payloads/libpayload/drivers/usb/uhci.c') diff --git a/payloads/libpayload/drivers/usb/uhci.c b/payloads/libpayload/drivers/usb/uhci.c index 70071eb595..e62fd25a2d 100644 --- a/payloads/libpayload/drivers/usb/uhci.c +++ b/payloads/libpayload/drivers/usb/uhci.c @@ -317,6 +317,8 @@ uhci_control (usbdev_t *dev, direction_t dir, int drlen, void *devreq, int dalen unsigned short req = ((unsigned short *) devreq)[0]; int i; td_t *tds = memalign (16, sizeof (td_t) * count); + if (!tds) + fatal("Not enough memory for uhci control.\n"); memset (tds, 0, sizeof (td_t) * count); count--; /* to compensate for 0-indexed array */ for (i = 0; i < count; i++) { @@ -386,6 +388,8 @@ create_schedule (int numpackets) if (numpackets == 0) return 0; td_t *tds = memalign (16, sizeof (td_t) * numpackets); + if (!tds) + fatal("Not enough memory for packets scheduling.\n"); memset (tds, 0, sizeof (td_t) * numpackets); int i; for (i = 0; i < numpackets; i++) { -- cgit v1.2.3