Mirrors/u-boot
1
0
Fork 0
mirror of https://source.denx.de/u-boot/u-boot.git synced 2026-06-13 15:03:58 +03:00
Code Issues Packages Projects Releases Wiki Activity

rockchip: avoid out-of-bounds when computing cpuid

Browse Source 
The expected length of the cpuid, as passed with cpuid_length,
determines the size of cpuid_str string. Therefore, care should be taken
to make sure nothing is accessing data out-of-bounds.

Instead of using hardcoded values, derive them from cpuid_length.

Cc: Quentin Schulz <foss+uboot@0leil.net>
Reviewed-by: Kever Yang <kever.yang@rock-chips.com>
Reviewed-by: Dragan Simic <dsimic@manjaro.org>
Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
This commit is contained in:
Quentin Schulz
2024-03-11 13:01:44 +01:00
committed by Kever Yang
parent 20a0ce574d
commit 2871dee833
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
arch/arm/mach-rockchip/misc.c
View File

@@ -102,7 +102,7 @@ int rockchip_cpuid_set(const u8 *cpuid, const u32 cpuid_length)
int i;
memset(cpuid_str, 0, sizeof(cpuid_str));
for (i = 0; i < 16; i++)
for (i = 0; i < cpuid_length; i++)
sprintf(&cpuid_str[i * 2], "%02x", cpuid[i]);
debug("cpuid: %s\n", cpuid_str);
@@ -111,13 +111,13 @@ int rockchip_cpuid_set(const u8 *cpuid, const u32 cpuid_length)
* Mix the cpuid bytes using the same rules as in
* ${linux}/drivers/soc/rockchip/rockchip-cpuinfo.c
*/
for (i = 0; i < 8; i++) {
for (i = 0; i < cpuid_length / 2; i++) {
low[i] = cpuid[1 + (i << 1)];
high[i] = cpuid[i << 1];
}
serialno = crc32_no_comp(0, low, 8);
serialno |= (u64)crc32_no_comp(serialno, high, 8) << 32;
serialno = crc32_no_comp(0, low, cpuid_length / 2);
serialno |= (u64)crc32_no_comp(serialno, high, cpuid_length / 2) << 32;
snprintf(serialno_str, sizeof(serialno_str), "%016llx", serialno);
oldid = env_get("cpuid#");