From: Francois Berder <fberder@outlook.fr>
Date: Sat, 9 May 2026 19:24:17 +0000 (+0200)
Subject: board: ten64: Fix OOB read in ft_board_setup
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=12cf77821de4234a604fb19a2266c8ecc3e66696;p=thirdparty%2Fu-boot.git

board: ten64: Fix OOB read in ft_board_setup

base and size arrays can both contain up to total_memory_banks
elements.
This commit fixes the for loop condition to ensure that it does
not attempt to read past the end of both arrays.

Signed-off-by: Francois Berder <fberder@outlook.fr>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
---

diff --git a/board/traverse/ten64/ten64.c b/board/traverse/ten64/ten64.c
index 5941ed11a60..ac8c9a9a81a 100644
--- a/board/traverse/ten64/ten64.c
+++ b/board/traverse/ten64/ten64.c
@@ -285,7 +285,7 @@ int ft_board_setup(void *blob, struct bd_info *bd)
 	}
 
 	if (mc_memory_base != 0) {
-		for (i = 0; i <= total_memory_banks; i++) {
+		for (i = 0; i < total_memory_banks; i++) {
 			if (base[i] == 0 && size[i] == 0) {
 				base[i] = mc_memory_base;
 				size[i] = mc_memory_size;