[PATCH] ram: renesas: dbsc5: Fix off by 1 errors
Marek Vasut
marek.vasut at mailbox.org
Wed Aug 20 22:47:12 CEST 2025
On 8/8/25 1:32 PM, Andrew Goodbody wrote:
> In dbsc5_read_vref_training the arrays dvw_min_byte0_table and
> dvw_min_byte1_table have 128 elements per channel. The variable
> vref_stop_index is limited to be a maximum of 128. This means that the
> index used to access the arrays must use a test of '< vref_stop_index'
> rather than '<= vref_stop_index' in order to prevent out of bounds
> accesses to the arrays.
>
> This issue was found by Smatch.
>
> Signed-off-by: Andrew Goodbody <andrew.goodbody at linaro.org>
This is a real nice find, thank you.
Reviewed-by: Marek Vasut <marek.vasut+renesas at mailbox.org>
Tested-by: Marek Vasut <marek.vasut+renesas at mailbox.org>
More information about the U-Boot
mailing list