board: nxp: Fix OOB read in ft_board_setup

base and size arrays can both contain up to total_memory_banks
elements.
This commit fixes the for loop condition to ensure that it does
not attempt to read past the end of both arrays.

Signed-off-by: Francois Berder <fberder@outlook.fr>
Signed-off-by: Peng Fan <peng.fan@nxp.com>

diff --git a/board/nxp/ls1088a/ls1088a.c b/board/nxp/ls1088a/ls1088a.c
index 51ec055be63a8160e26e1e2efe193091a403effe..5783dd8a4039e9661d88618407c55f6fac650aff 100644 (file)
--- a/board/nxp/ls1088a/ls1088a.c
+++ b/board/nxp/ls1088a/ls1088a.c
@@ -974,7 +974,7 @@ int ft_board_setup(void *blob, struct bd_info *bd)
 #endif
 
        if (mc_memory_base != 0) {
-               for (i = 0; i <= total_memory_banks; i++) {
+               for (i = 0; i < total_memory_banks; i++) {
                        if (base[i] == 0 && size[i] == 0) {
                                base[i] = mc_memory_base;
                                size[i] = mc_memory_size;

diff --git a/board/nxp/ls2080ardb/ls2080ardb.c b/board/nxp/ls2080ardb/ls2080ardb.c
index 6f824f57c478496e93e753e2336328edcd1934e9..d08598d1c62da539139dc9b0c44cb223b72a8751 100644 (file)
--- a/board/nxp/ls2080ardb/ls2080ardb.c
+++ b/board/nxp/ls2080ardb/ls2080ardb.c
@@ -503,7 +503,7 @@ int ft_board_setup(void *blob, struct bd_info *bd)
 #endif
 
        if (mc_memory_base != 0) {
-               for (i = 0; i <= total_memory_banks; i++) {
+               for (i = 0; i < total_memory_banks; i++) {
                        if (base[i] == 0 && size[i] == 0) {
                                base[i] = mc_memory_base;
                                size[i] = mc_memory_size;

diff --git a/board/nxp/lx2160a/lx2160a.c b/board/nxp/lx2160a/lx2160a.c
index 341f82ce72450b857f7a9a772b70c9e87b686943..d34865de8c2cca911ca4e492ace984f820ae2457 100644 (file)
--- a/board/nxp/lx2160a/lx2160a.c
+++ b/board/nxp/lx2160a/lx2160a.c
@@ -818,7 +818,7 @@ int ft_board_setup(void *blob, struct bd_info *bd)
 #endif
 
        if (mc_memory_base != 0) {
-               for (i = 0; i <= total_memory_banks; i++) {
+               for (i = 0; i < total_memory_banks; i++) {
                        if (base[i] == 0 && size[i] == 0) {
                                base[i] = mc_memory_base;
                                size[i] = mc_memory_size;