GNUBoot
/
coreboot-kgpe-d16
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

intel/common/block: Fix potential buffer overflow 

Possible Buffer Overflow - Array Index Out of Bounds. Array
regions size is 256 but 'i' iterates from 0 to 256.

Found-by: Klockwork
BUG=None
BRANCH=firmware-brya-14505.B
TEST=Boot to OS

Signed-off-by: Bora Guvendik <bora.guvendik@intel.com>
Change-Id: Iee45a5821b9dd3f9e6f9816599beebf34555426d
Reviewed-on: https://review.coreboot.org/c/coreboot/+/72049
Reviewed-by: Hannah Williams <hannah.williams@intel.com>
Reviewed-by: Jérémy Compostella <jeremy.compostella@intel.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
This commit is contained in:
Bora Guvendik 2023-01-17 12:09:56 -08:00 committed by Felix Held
parent 5e2d9c0979
commit adb52533fc
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/soc/intel/common/block/crashlog/crashlog.c
View File

@ -145,16 +145,18 @@ int pmc_cl_gen_descriptor_table(u32 desc_table_addr,
printk(BIOS_DEBUG, "CL PMC desc table: numb of regions is 0x%x at addr 0x%x\n",
descriptor_table->numb_regions, desc_table_addr);
for (int i = 0; i < descriptor_table->numb_regions; i++) {
if (i >= ARRAY_SIZE(descriptor_table->regions)) {
printk(BIOS_ERR, "Maximum number of PMC crashLog descriptor table exceeded (%u/%zu)\n",
descriptor_table->numb_regions,
ARRAY_SIZE(descriptor_table->regions));
break;
}
desc_table_addr += 4;
descriptor_table->regions[i].data = read32((u32 *)(desc_table_addr));
total_data_size += descriptor_table->regions[i].bits.size * sizeof(u32);
printk(BIOS_DEBUG, "CL PMC desc table: region 0x%x has size 0x%x at offset 0x%x\n",
i, descriptor_table->regions[i].bits.size,
descriptor_table->regions[i].bits.offset);
if (i > 255) {
printk(BIOS_ERR, "More than 255 regions in PMC crashLog descriptor table");
break;
}
}
return total_data_size;
}