From 0decccb666245e38bfd0595e8c7e312c6937c465 Mon Sep 17 00:00:00 2001 From: Jacob Garber Date: Fri, 29 Mar 2019 18:33:32 -0600 Subject: soc/intel/baytrail: Correct array bounds check If `gms == ARRAY_SIZE(gms_size_map)`, then we will have an out of bounds read. Fix the check to exclude this case. This was partially fixed in 04f68c1 (baytrail: fix range check). Found-by: Coverity Scan, CID 1229677 (OVERRUN) Signed-off-by: Jacob Garber Change-Id: I8c8cd59df49beea066b46cde3cf00237816aff33 Reviewed-on: https://review.coreboot.org/c/coreboot/+/32125 Tested-by: build bot (Jenkins) Reviewed-by: Paul Menzel Reviewed-by: Patrick Georgi --- src/soc/intel/baytrail/gfx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/soc/intel/baytrail') diff --git a/src/soc/intel/baytrail/gfx.c b/src/soc/intel/baytrail/gfx.c index 5d6d504a86..d2cb589db8 100644 --- a/src/soc/intel/baytrail/gfx.c +++ b/src/soc/intel/baytrail/gfx.c @@ -48,7 +48,7 @@ static void gfx_lock_pcbase(struct device *dev) gms = pci_read_config32(dev, GGC) & GGC_GSM_SIZE_MASK; gms >>= 3; - if (gms > ARRAY_SIZE(gms_size_map)) + if (gms >= ARRAY_SIZE(gms_size_map)) return; gmsize = gms_size_map[gms]; -- cgit v1.2.3