erebion/coreboot
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

mb/lenovo/sklkbl/spd: Fix integer overflow

Browse source 
This fixes an integer overflow in the calculation of the offset within
the SPD binary that has caused memory detection failures on some
machines (e.g. this resolves https://ticket.coreboot.org/issues/627 ).
In a nutshell, spd_index (uint8_t) receives an assigned multiplication
by 512 (SPD_SIZE_MAX_DDR4) which will always truncate the result.

Change-Id: I048a73c18c9a3d1b20e2a4276e1714e59550eaf5
Signed-off-by: Johann C. Rode <jcrode@gmx.net>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/91170
Reviewed-by: Patrick Rudolph <patrick.rudolph@9elements.com>
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
This commit is contained in:
Johann C. Rode 2026-02-11 20:07:01 -08:00 • committed by Matt DeVillier
commit 3b9fae176d
1 changed files with 1 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/mainboard/lenovo/sklkbl_thinkpad/spd/spd.c
View file

@ -28,8 +28,7 @@ uint8_t *mainboard_find_spd_data(uint8_t spd_index)
die("Missing SPD data (spd.bin size %zu smaller than SPD size %u).", spd_file_len, SPD_SIZE_MAX_DDR4);
/* Assume same memory in both channels */
spd_index *= SPD_SIZE_MAX_DDR4;
spd_data = (uint8_t *)(spd_file + spd_index);
spd_data = (uint8_t *)(spd_file + spd_index * SPD_SIZE_MAX_DDR4);
/* Make sure a valid SPD was found */
if (spd_data[0] == 0)