From: Francois Berder Date: Sat, 9 May 2026 19:20:18 +0000 (+0200) Subject: board: nxp: Fix OOB read in ft_board_setup X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=408cab5f9d940950977f2ba86efa385ad880c702;p=thirdparty%2Fu-boot.git board: nxp: Fix OOB read in ft_board_setup base and size arrays can both contain up to total_memory_banks elements. This commit fixes the for loop condition to ensure that it does not attempt to read past the end of both arrays. Signed-off-by: Francois Berder Signed-off-by: Peng Fan --- diff --git a/board/nxp/ls1088a/ls1088a.c b/board/nxp/ls1088a/ls1088a.c index 51ec055be63..5783dd8a403 100644 --- a/board/nxp/ls1088a/ls1088a.c +++ b/board/nxp/ls1088a/ls1088a.c @@ -974,7 +974,7 @@ int ft_board_setup(void *blob, struct bd_info *bd) #endif if (mc_memory_base != 0) { - for (i = 0; i <= total_memory_banks; i++) { + for (i = 0; i < total_memory_banks; i++) { if (base[i] == 0 && size[i] == 0) { base[i] = mc_memory_base; size[i] = mc_memory_size; diff --git a/board/nxp/ls2080ardb/ls2080ardb.c b/board/nxp/ls2080ardb/ls2080ardb.c index 6f824f57c47..d08598d1c62 100644 --- a/board/nxp/ls2080ardb/ls2080ardb.c +++ b/board/nxp/ls2080ardb/ls2080ardb.c @@ -503,7 +503,7 @@ int ft_board_setup(void *blob, struct bd_info *bd) #endif if (mc_memory_base != 0) { - for (i = 0; i <= total_memory_banks; i++) { + for (i = 0; i < total_memory_banks; i++) { if (base[i] == 0 && size[i] == 0) { base[i] = mc_memory_base; size[i] = mc_memory_size; diff --git a/board/nxp/lx2160a/lx2160a.c b/board/nxp/lx2160a/lx2160a.c index 341f82ce724..d34865de8c2 100644 --- a/board/nxp/lx2160a/lx2160a.c +++ b/board/nxp/lx2160a/lx2160a.c @@ -818,7 +818,7 @@ int ft_board_setup(void *blob, struct bd_info *bd) #endif if (mc_memory_base != 0) { - for (i = 0; i <= total_memory_banks; i++) { + for (i = 0; i < total_memory_banks; i++) { if (base[i] == 0 && size[i] == 0) { base[i] = mc_memory_base; size[i] = mc_memory_size;