From 2868f26131308ff345382084681ea89c5b0159f1 Mon Sep 17 00:00:00 2001 From: Heinrich Schuchardt Date: Fri, 31 Mar 2023 15:15:15 +0200 Subject: [PATCH] lib: utils: fdt_fixup: avoid buffer overrun fdt_reserved_memory_fixup() uses filtered_order[PMP_COUNT]. The index must not reach PMP_COUNT. Fixes: 199189bd1c17 ("lib: utils: Mark only the largest region as reserved in FDT") Addresses-Coverity-ID: 1536994 ("Out-of-bounds write") Signed-off-by: Heinrich Schuchardt Reviewed-by: Xiang W Reviewed-by: Anup Patel --- lib/utils/fdt/fdt_fixup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/utils/fdt/fdt_fixup.c b/lib/utils/fdt/fdt_fixup.c index c10179b..ae6be00 100644 --- a/lib/utils/fdt/fdt_fixup.c +++ b/lib/utils/fdt/fdt_fixup.c @@ -355,7 +355,7 @@ int fdt_reserved_memory_fixup(void *fdt) if (reg->flags & SBI_DOMAIN_MEMREGION_SU_EXECUTABLE) continue; - if (i > PMP_COUNT) { + if (i >= PMP_COUNT) { sbi_printf("%s: Too many memory regions to fixup.\n", __func__); return SBI_ENOSPC;