diff options
| author | Kamalesh Babulal <kamalesh@linux.vnet.ibm.com> | 2015-06-23 14:07:37 +0530 |
|---|---|---|
| committer | Stewart Smith <stewart@linux.vnet.ibm.com> | 2015-06-24 16:11:26 +1000 |
| commit | 7f3f03547fa8b2225dd70e49efdedcd7cb585744 (patch) | |
| tree | 79ca08207058d7e6d436d6ba7332d64738d5bef4 | |
| parent | 4608ccb1308a9cc35a43ad0b54c9de1ca1934bd3 (diff) | |
| download | blackbird-skiboot-7f3f03547fa8b2225dd70e49efdedcd7cb585744.tar.gz blackbird-skiboot-7f3f03547fa8b2225dd70e49efdedcd7cb585744.zip | |
Fix potential overrun of p7ioc_phb->{tve_hi_cache, tve_hi_cache}
p7ioc_phb->{tve_hi_cache, tve_hi_cache} are array with upper bound
of 128. In p7ioc_map_pe_dma_window(), we check if the range is 1..255,
which might overrun the array.
Fix it by checking for array index not greater than 127.
Fixes Coverity Defect#97847.
Signed-off-by: Kamalesh Babulal <kamalesh@linux.vnet.ibm.com>
Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
| -rw-r--r-- | hw/p7ioc-phb.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/hw/p7ioc-phb.c b/hw/p7ioc-phb.c index d2823635..0b37993c 100644 --- a/hw/p7ioc-phb.c +++ b/hw/p7ioc-phb.c @@ -1850,7 +1850,7 @@ static int64_t p7ioc_map_pe_dma_window(struct phb *phb, uint16_t pe_number, uint64_t dma_window_size; uint64_t *cache_lo, *cache_hi; - if (pe_number > 127 || window_id > 255 || tce_levels != 1) + if (pe_number > 127 || window_id > 127 || tce_levels != 1) return OPAL_PARAMETER; cache_lo = &p->tve_lo_cache[window_id]; cache_hi = &p->tve_hi_cache[window_id]; |
