leandrof/u-boot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ARC: Fix iteration in arc_xx_version()

Browse Source 
"i" gets incremented before we're entering loop body
and effectively we iterate from 1 to 8 instead of 0 to 7.

This way we:
 a) Skip the first line of struct hs_versions
 b) Go over it and access memory beyond the structure

Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
This commit is contained in:
Alexey Brodkin 2019-01-22 19:33:59 +03:00 committed by Alexey Brodkin
parent d771dd531a
commit 7181a6d1cf
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
arch/arc/lib/cpu.c
View File

@ -87,7 +87,7 @@ const char *arc_em_version(int arcver, char *name, int name_len)
bool xymem = ARC_FEATURE_EXISTS(ARC_AUX_XY_BUILD);
int i;
for (i = 0; i++ < sizeof(em_versions) / sizeof(struct em_template_t);) {
for (i = 0; i < sizeof(em_versions) / sizeof(struct em_template_t); i++) {
if (em_versions[i].cache == cache &&
em_versions[i].dsp == dsp &&
em_versions[i].xymem == xymem) {
@ -147,7 +147,7 @@ const char *arc_hs_version(int arcver, char *name, int name_len)
bool dual_issue = arcver == 0x54 ? true : false;
int i;
for (i = 0; i++ < sizeof(hs_versions) / sizeof(struct hs_template_t);) {
for (i = 0; i < sizeof(hs_versions) / sizeof(struct hs_template_t); i++) {
if (hs_versions[i].cache == cache &&
hs_versions[i].mmu == mmu &&
hs_versions[i].dual_issue == dual_issue &&