From: Md Shofiqul Islam Date: Sun, 5 Jul 2026 10:08:41 +0000 (+0300) Subject: ge: common: vpd_reader: fix errloc array size in verify_bch() X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d2d005a32b97173d41ac99bfd19d7c9b73184d3a;p=thirdparty%2Fu-boot.git ge: common: vpd_reader: fix errloc array size in verify_bch() errloc stores bit positions of errors returned by decode_bch(). The maximum number of correctable errors is ecc_bits, so errloc must have ecc_bits entries. The array was allocated with data_length entries instead, which is the number of EEPROM data bytes -- orders of magnitude larger than needed and incorrect. Fixes: b418dfe16e62 ("board: ge: make VPD code common") Signed-off-by: Md Shofiqul Islam --- diff --git a/board/ge/common/vpd_reader.c b/board/ge/common/vpd_reader.c index 2422db38013..b3f9e96615d 100644 --- a/board/ge/common/vpd_reader.c +++ b/board/ge/common/vpd_reader.c @@ -66,7 +66,7 @@ static int verify_bch(int ecc_bits, unsigned int prim_poly, u8 *data, return -1; } - unsigned int *errloc = (unsigned int *)calloc(data_length, + unsigned int *errloc = (unsigned int *)calloc(ecc_bits, sizeof(unsigned int)); int errors = decode_bch(bch, data, data_length, ecc, NULL, NULL, errloc);