From f35cc4d60ff86f1f0d7a5f423e0a092e9c45990e Mon Sep 17 00:00:00 2001 From: Richard Spiegel Date: Wed, 28 Mar 2018 13:43:48 -0700 Subject: soc/amd/common/block/pi/amd_late_init.c: Fix illegal memory access Found-by: Coverity (CID 1387031: Memory - illegal accesses (BUFFER_SIZE_WARNING)). Calling strncpy with a maximum size argument of 19 bytes on destination array "dimm->module_part_number" of size 19 bytes might leave the destination string unterminated. Fix the size parameter. BUG=b:76202696 TEST=Build and boot kahlee, using special debug code to see the output strings, which was later removed. Change-Id: I18fa5e9c73401575441b6810f1db80d11666368c Signed-off-by: Richard Spiegel Reviewed-on: https://review.coreboot.org/25419 Tested-by: build bot (Jenkins) Reviewed-by: Martin Roth --- src/soc/amd/common/block/pi/amd_late_init.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'src/soc') diff --git a/src/soc/amd/common/block/pi/amd_late_init.c b/src/soc/amd/common/block/pi/amd_late_init.c index b410602694..68cf3a1ba3 100644 --- a/src/soc/amd/common/block/pi/amd_late_init.c +++ b/src/soc/amd/common/block/pi/amd_late_init.c @@ -59,9 +59,7 @@ static void transfer_memory_info(TYPE17_DMI_INFO *dmi17, dimm->bank_locator = 0; strncpy((char *)dimm->module_part_number, dmi17->PartNumber, - sizeof(dimm->module_part_number)); - - dimm->module_part_number[sizeof(dimm->module_part_number) - 1] = 0; + sizeof(dimm->module_part_number) - 1); } static void print_dimm_info(const struct dimm_info *dimm) -- cgit v1.2.3