Mirrors/u-boot
2
0
Fork 0
mirror of https://github.com/AsahiLinux/u-boot synced 2024-11-28 07:31:15 +00:00
Code Issues Projects Releases Packages Wiki Activity

firmware: scmi: correct a validity check against power domain id

Browse source 
A power domain id on sandbox should be in the range from zero to
ARRAY_SIZE(scmi_pwdom) - 1. Correct the validity check logic.

Addresses-Coverity-ID: 467401 ("Out-of-bounds write")
Addresses-Coverity-ID: 467405 ("Out-of-bounds read")
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
This commit is contained in:
AKASHI Takahiro 2023-11-07 09:05:47 +09:00 committed by Tom Rini
parent d2174dbff1
commit 4808d16333
1 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
drivers/firmware/scmi/sandbox-scmi_agent.c
View file

@ -576,7 +576,7 @@ static int sandbox_scmi_pwd_attribs(struct udevice *dev, struct scmi_msg *msg)
domain_id = *(u32 *)msg->in_msg;
out = (struct scmi_pwd_attrs_out *)msg->out_msg;
if (domain_id > ARRAY_SIZE(scmi_pwdom)) {
if (domain_id >= ARRAY_SIZE(scmi_pwdom)) {
out->status = SCMI_NOT_FOUND;
return 0;
@ -613,7 +613,7 @@ static int sandbox_scmi_pwd_state_set(struct udevice *dev, struct scmi_msg *msg)
in = (struct scmi_pwd_state_set_in *)msg->in_msg;
status = (s32 *)msg->out_msg;
if (in->domain_id > ARRAY_SIZE(scmi_pwdom)) {
if (in->domain_id >= ARRAY_SIZE(scmi_pwdom)) {
*status = SCMI_NOT_FOUND;
return 0;
@ -653,7 +653,7 @@ static int sandbox_scmi_pwd_state_get(struct udevice *dev, struct scmi_msg *msg)
domain_id = *(u32 *)msg->in_msg;
out = (struct scmi_pwd_state_get_out *)msg->out_msg;
if (domain_id > ARRAY_SIZE(scmi_pwdom)) {
if (domain_id >= ARRAY_SIZE(scmi_pwdom)) {
out->status = SCMI_NOT_FOUND;
return 0;
@ -686,7 +686,7 @@ static int sandbox_scmi_pwd_name_get(struct udevice *dev, struct scmi_msg *msg)
domain_id = *(u32 *)msg->in_msg;
out = (struct scmi_pwd_name_get_out *)msg->out_msg;
if (domain_id > ARRAY_SIZE(scmi_pwdom)) {
if (domain_id >= ARRAY_SIZE(scmi_pwdom)) {
out->status = SCMI_NOT_FOUND;
return 0;