GNUBoot
/
coreboot-kgpe-d16
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

acpi/soundwire.[ch]: Fix dpn entry array overrun 

In soundwire.h, SOUNDWIRE_DPN MIN  & MAX are set to 1 and 14. When
creating the dpn array, the length was set to MAX - MIN or 13, numbered
0 to 12.

When accessing the array, the code was bailing out if a value greater
than MAX was trying to be accessed, so the array was able to be overrun
by two structure lengths.

Fix this problem by:
1) Not subtracting the MIN value when creating the array, which does
waste a little space. If anyone wants to refactor the code to fix that,
please feel free.
2) Breaking out of the loop when the port is equal to the MAX port
number instead of just when it's greater than the max port number.

Reported-by: Coverity (CID:1429766 & CID:1429771)
Signed-off-by: Martin Roth <gaumless@gmail.com>
Change-Id: I0841bb8c9869fe9f53958f05614848785a98b766
Reviewed-on: https://review.coreboot.org/c/coreboot/+/77777
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Tim Wawrzynczak <inforichland@gmail.com>
This commit is contained in:
Martin Roth 2023-09-11 13:40:55 -06:00 committed by Felix Held
parent 3c4e0ad561
commit 22e16db4c5
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/acpi/soundwire.c
View File

@ -400,7 +400,7 @@ void soundwire_gen_codec(struct acpi_dp *dsd, const struct soundwire_codec *code
struct acpi_dp *dpn; struct acpi_dp *dpn;
/* Stop processing at the first invalid data port. */ /* Stop processing at the first invalid data port. */
if (entry->port < SOUNDWIRE_MIN_DPN || entry->port > SOUNDWIRE_MAX_DPN) if (entry->port < SOUNDWIRE_MIN_DPN || entry->port >= SOUNDWIRE_MAX_DPN)
break; break;
if (entry->source) { if (entry->source) {

2
src/include/device/soundwire.h
View File

@ -419,7 +419,7 @@ struct soundwire_dpn_entry {
struct soundwire_codec { struct soundwire_codec {
struct soundwire_slave *slave; struct soundwire_slave *slave;
struct soundwire_audio_mode *audio_mode[SOUNDWIRE_MAX_MODE]; struct soundwire_audio_mode *audio_mode[SOUNDWIRE_MAX_MODE];
struct soundwire_dpn_entry dpn[SOUNDWIRE_MAX_DPN - SOUNDWIRE_MIN_DPN]; struct soundwire_dpn_entry dpn[SOUNDWIRE_MAX_DPN];
struct soundwire_bra_mode *dp0_bra_mode[SOUNDWIRE_MAX_MODE]; struct soundwire_bra_mode *dp0_bra_mode[SOUNDWIRE_MAX_MODE];
struct soundwire_dp0 *dp0; struct soundwire_dp0 *dp0;
struct soundwire_multilane *multilane; struct soundwire_multilane *multilane;