soc/intel/skylake: fix memory access beyond array bounds
chip.h has a config array PcieRpClkReqNumber which corresponds to a FSP UPD parameter, the size is currently set to 20. However the size of PcieRpClkReqNumber UPD in FSP2.0 is 24, so memcpy (config buffer to UPD buffer) in chip_fsp20.c will read beyond the bounds of config array. Hence set the size of PcieRpClkReqNumber array based on the FSP in use. Found-by: Coverity Scan #1365385, #1365386 Change-Id: I937f68ef33f218cd7f9ba5cf3baaec162bca3fc8 Signed-off-by: Rizwan Qureshi <rizwan.qureshi@intel.com> Reviewed-on: https://review.coreboot.org/17292 Tested-by: build bot (Jenkins) Reviewed-by: Aaron Durbin <adurbin@chromium.org>
This commit is contained in:
parent
1ec0c00179
commit
d8bb69a451
|
@ -239,4 +239,9 @@ config SPI_FLASH_INCLUDE_ALL_DRIVERS
|
|||
bool
|
||||
default n
|
||||
|
||||
config MAX_ROOT_PORTS
|
||||
int
|
||||
default 24 if PLATFORM_USES_FSP2_0
|
||||
default 20 if PLATFORM_USES_FSP1_1
|
||||
|
||||
endif
|
||||
|
|
|
@ -161,9 +161,9 @@ struct soc_intel_skylake_config {
|
|||
u8 EnableTraceHub;
|
||||
|
||||
/* Pcie Root Ports */
|
||||
u8 PcieRpEnable[20];
|
||||
u8 PcieRpClkReqSupport[20];
|
||||
u8 PcieRpClkReqNumber[20];
|
||||
u8 PcieRpEnable[CONFIG_MAX_ROOT_PORTS];
|
||||
u8 PcieRpClkReqSupport[CONFIG_MAX_ROOT_PORTS];
|
||||
u8 PcieRpClkReqNumber[CONFIG_MAX_ROOT_PORTS];
|
||||
|
||||
/* USB related */
|
||||
struct usb2_port_config usb2_ports[16];
|
||||
|
|
Loading…
Reference in New Issue