From 8a661ed788ff1373015a5c6b705e2e32b63ebe4a Mon Sep 17 00:00:00 2001 From: Edward O'Callaghan Date: Wed, 21 May 2014 09:42:56 +1000 Subject: amd/cimx/sb?00/SATA.c: Integer overflow in loop condition The conditional comparison in the for-loop construct with the constant 300000 has an index incrementor of type 'UINT16' (aka 'unsigned short') which is always true. Change-Id: I932c168742163be4038728fb40833231a447fa78 Signed-off-by: Edward O'Callaghan Reviewed-on: http://review.coreboot.org/5799 Tested-by: build bot (Jenkins) Reviewed-by: Marc Jones --- src/vendorcode/amd/cimx/sb700/SATA.c | 2 +- src/vendorcode/amd/cimx/sb800/SATA.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) (limited to 'src/vendorcode') diff --git a/src/vendorcode/amd/cimx/sb700/SATA.c b/src/vendorcode/amd/cimx/sb700/SATA.c index 09d49237ea..d5032397fe 100644 --- a/src/vendorcode/amd/cimx/sb700/SATA.c +++ b/src/vendorcode/amd/cimx/sb700/SATA.c @@ -238,7 +238,7 @@ void sataInitAfterPciEnum(AMDSBCFG* pConfig){ void sataDriveDetection(AMDSBCFG* pConfig, UINT32 ddBar5){ UINT32 ddVar0; UINT8 dbPortNum, dbVar0; - UINT16 dwIoBase, dwVar0; + UINT32 dwIoBase, dwVar0; TRACE((DMSG_SB_TRACE, "CIMx - Entering sata drive detection procedure\n\n")); TRACE((DMSG_SB_TRACE, "SATA BAR5 is %X \n", ddBar5)); diff --git a/src/vendorcode/amd/cimx/sb800/SATA.c b/src/vendorcode/amd/cimx/sb800/SATA.c index a3012086e5..73f29687cc 100644 --- a/src/vendorcode/amd/cimx/sb800/SATA.c +++ b/src/vendorcode/amd/cimx/sb800/SATA.c @@ -568,7 +568,7 @@ sataDriveDetection ( UINT8 dbPortNum; UINT8 dbVar0; UINT16 dwIoBase; - UINT16 dwVar0; + UINT32 dwVar0; if ( (pConfig->SataClass == NATIVE_IDE_MODE) || (pConfig->SataClass == LEGACY_IDE_MODE) || (pConfig->SataClass == IDE_TO_AHCI_MODE) ) { for ( dbPortNum = 0; dbPortNum < 4; dbPortNum++ ) { ReadMEM (*pBar5 + SB_SATA_BAR5_REG128 + dbPortNum * 0x80, AccWidthUint32, &ddVar0); -- cgit v1.2.3