From 12cf77821de4234a604fb19a2266c8ecc3e66696 Mon Sep 17 00:00:00 2001 From: Francois Berder Date: Sat, 9 May 2026 21:24:17 +0200 Subject: [PATCH] board: ten64: Fix OOB read in ft_board_setup base and size arrays can both contain up to total_memory_banks elements. This commit fixes the for loop condition to ensure that it does not attempt to read past the end of both arrays. Signed-off-by: Francois Berder Signed-off-by: Peng Fan --- board/traverse/ten64/ten64.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/board/traverse/ten64/ten64.c b/board/traverse/ten64/ten64.c index 5941ed11a60..ac8c9a9a81a 100644 --- a/board/traverse/ten64/ten64.c +++ b/board/traverse/ten64/ten64.c @@ -285,7 +285,7 @@ int ft_board_setup(void *blob, struct bd_info *bd) } if (mc_memory_base != 0) { - for (i = 0; i <= total_memory_banks; i++) { + for (i = 0; i < total_memory_banks; i++) { if (base[i] == 0 && size[i] == 0) { base[i] = mc_memory_base; size[i] = mc_memory_size;