From 159cd3f42144c196e19d7d497085b51d0f4cd52c Mon Sep 17 00:00:00 2001 From: Joe Moore Date: Mon, 21 Oct 2019 03:32:38 -0600 Subject: vc/amd/agesa: Fix out of bounds read ByteLane is used unitialized from prior for statement, creating a potential out-of-bound read of RxOrig[MaxByteLanes]. PassTestRxEnDly[MaxByteLanes] never appears as rvalue; all for loops have ByteLane < MaxByteLanes exit condition. Change-Id: Icd18a146aba6b6120d37518d8c40c7efbc05afa3 Signed-off-by: Joe Moore Found-by: Coverity CID 1241804 Reviewed-on: https://review.coreboot.org/c/coreboot/+/36192 Tested-by: build bot (Jenkins) Reviewed-by: Mike Banon --- src/vendorcode/amd/agesa/f15tn/Proc/Mem/Tech/mtthrcSeedTrain.c | 2 +- src/vendorcode/amd/agesa/f16kb/Proc/Mem/Tech/mtthrcSeedTrain.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) (limited to 'src/vendorcode') diff --git a/src/vendorcode/amd/agesa/f15tn/Proc/Mem/Tech/mtthrcSeedTrain.c b/src/vendorcode/amd/agesa/f15tn/Proc/Mem/Tech/mtthrcSeedTrain.c index 3406d76306..991667bca2 100644 --- a/src/vendorcode/amd/agesa/f15tn/Proc/Mem/Tech/mtthrcSeedTrain.c +++ b/src/vendorcode/amd/agesa/f15tn/Proc/Mem/Tech/mtthrcSeedTrain.c @@ -313,7 +313,6 @@ MemTRdPosWithRxEnDlySeeds3 ( // IDS_HDT_CONSOLE (MEM_FLOW, "\n\t\t Setting PassTestRxEnDly\n"); IDS_HDT_CONSOLE (MEM_FLOW, "\t PassTestRxEnDly: "); - PassTestRxEnDly[ByteLane] = RxOrig[ByteLane]; for (ByteLane = 0; ByteLane < MaxByteLanes; ByteLane++) { if (RxEnDlyTargetFound[ByteLane] == FALSE) { // Calculate "PassTestRxEnDly" from current "RxEnDly" @@ -328,6 +327,7 @@ MemTRdPosWithRxEnDlySeeds3 ( MemTRdPosRxEnSeedSetDly3 (TechPtr, PassTestRxEnDly[ByteLane], ByteLane); OutOfRange[ByteLane] = FALSE; } else { + PassTestRxEnDly[ByteLane] = RxOrig[ByteLane]; OutOfRange[ByteLane] = TRUE; } } else { diff --git a/src/vendorcode/amd/agesa/f16kb/Proc/Mem/Tech/mtthrcSeedTrain.c b/src/vendorcode/amd/agesa/f16kb/Proc/Mem/Tech/mtthrcSeedTrain.c index ce295acc80..1446f3e009 100644 --- a/src/vendorcode/amd/agesa/f16kb/Proc/Mem/Tech/mtthrcSeedTrain.c +++ b/src/vendorcode/amd/agesa/f16kb/Proc/Mem/Tech/mtthrcSeedTrain.c @@ -314,7 +314,6 @@ MemTRdPosWithRxEnDlySeeds3 ( // IDS_HDT_CONSOLE (MEM_FLOW, "\n\t\t Setting PassTestRxEnDly\n"); IDS_HDT_CONSOLE (MEM_FLOW, "\t PassTestRxEnDly: "); - PassTestRxEnDly[ByteLane] = RxOrig[ByteLane]; for (ByteLane = 0; ByteLane < MaxByteLanes; ByteLane++) { if (RxEnDlyTargetFound[ByteLane] == FALSE) { // Calculate "PassTestRxEnDly" from current "RxEnDly" @@ -329,6 +328,7 @@ MemTRdPosWithRxEnDlySeeds3 ( MemTRdPosRxEnSeedSetDly3 (TechPtr, PassTestRxEnDly[ByteLane], ByteLane); OutOfRange[ByteLane] = FALSE; } else { + PassTestRxEnDly[ByteLane] = RxOrig[ByteLane]; OutOfRange[ByteLane] = TRUE; } } else { -- cgit v1.2.3