diff options
| author | Francois Berder <[email protected]> | 2026-05-09 21:20:18 +0200 |
|---|---|---|
| committer | Peng Fan <[email protected]> | 2026-05-15 19:28:31 +0800 |
| commit | 408cab5f9d940950977f2ba86efa385ad880c702 (patch) | |
| tree | ef107e398fd82b429a8c309f1e9e20d1d33cf587 | |
| parent | 9a621ea6355c5ec73c09c56fc691c70cc93c0692 (diff) | |
board: nxp: Fix OOB read in ft_board_setup
base and size arrays can both contain up to total_memory_banks
elements.
This commit fixes the for loop condition to ensure that it does
not attempt to read past the end of both arrays.
Signed-off-by: Francois Berder <[email protected]>
Signed-off-by: Peng Fan <[email protected]>
| -rw-r--r-- | board/nxp/ls1088a/ls1088a.c | 2 | ||||
| -rw-r--r-- | board/nxp/ls2080ardb/ls2080ardb.c | 2 | ||||
| -rw-r--r-- | board/nxp/lx2160a/lx2160a.c | 2 |
3 files changed, 3 insertions, 3 deletions
diff --git a/board/nxp/ls1088a/ls1088a.c b/board/nxp/ls1088a/ls1088a.c index 51ec055be63..5783dd8a403 100644 --- a/board/nxp/ls1088a/ls1088a.c +++ b/board/nxp/ls1088a/ls1088a.c @@ -974,7 +974,7 @@ int ft_board_setup(void *blob, struct bd_info *bd) #endif if (mc_memory_base != 0) { - for (i = 0; i <= total_memory_banks; i++) { + for (i = 0; i < total_memory_banks; i++) { if (base[i] == 0 && size[i] == 0) { base[i] = mc_memory_base; size[i] = mc_memory_size; diff --git a/board/nxp/ls2080ardb/ls2080ardb.c b/board/nxp/ls2080ardb/ls2080ardb.c index 6f824f57c47..d08598d1c62 100644 --- a/board/nxp/ls2080ardb/ls2080ardb.c +++ b/board/nxp/ls2080ardb/ls2080ardb.c @@ -503,7 +503,7 @@ int ft_board_setup(void *blob, struct bd_info *bd) #endif if (mc_memory_base != 0) { - for (i = 0; i <= total_memory_banks; i++) { + for (i = 0; i < total_memory_banks; i++) { if (base[i] == 0 && size[i] == 0) { base[i] = mc_memory_base; size[i] = mc_memory_size; diff --git a/board/nxp/lx2160a/lx2160a.c b/board/nxp/lx2160a/lx2160a.c index 341f82ce724..d34865de8c2 100644 --- a/board/nxp/lx2160a/lx2160a.c +++ b/board/nxp/lx2160a/lx2160a.c @@ -818,7 +818,7 @@ int ft_board_setup(void *blob, struct bd_info *bd) #endif if (mc_memory_base != 0) { - for (i = 0; i <= total_memory_banks; i++) { + for (i = 0; i < total_memory_banks; i++) { if (base[i] == 0 && size[i] == 0) { base[i] = mc_memory_base; size[i] = mc_memory_size; |