the following patch was just integrated into master:
commit 2b48b65b1980c4edb6391e4ccf6b1bd8313be944
Author: Edward O'Callaghan <eocallaghan(a)alterapraxis.com>
Date: Sun Aug 3 23:38:17 2014 +1000
northbridge/intel: Out of bounds write to array in gma.h
The signature[] array in the mailbox struct opregion_header_t has
IGD_OPREGION_SIGNATURE written to it with a
sizeof(IGD_OPREGION_SIGNATURE) and not a sizeof(signature[]). This
resulted in a silent off-by-one out of bounds illegal write.
Change-Id: I651620a753c743dd2ed2af51c012c27c14a5ea25
Found-by: Coverity Scan
Signed-off-by: Edward O'Callaghan <eocallaghan(a)alterapraxis.com>
Reviewed-on: http://review.coreboot.org/6473
Tested-by: build bot (Jenkins)
Reviewed-by: Patrick Georgi <patrick(a)georgi-clan.de>
See http://review.coreboot.org/6473 for details.
-gerrit
the following patch was just integrated into master:
commit 5cfef13f8d13b378f72b61ba3e4d7eee065f6d26
Author: Edward O'Callaghan <eocallaghan(a)alterapraxis.com>
Date: Sun Aug 3 20:00:47 2014 +1000
cpu/intel: Fix out-of-bounds read due to off-by-one in condition
If power_limit_1_time > 129 is false then power_limit_1_time can have a
value of up to 129 leading to an out-of-bounds illegal read indexing the
power_limit_time_sec_to_msr[] array. Thankfully all call sites have been
doing the right thing up until now so the issue has not been visible.
Change-Id: Ic029d1af7fe43ca7da271043c2b08fe3088714af
Found-by: Coverity Scan
Signed-off-by: Edward O'Callaghan <eocallaghan(a)alterapraxis.com>
Reviewed-on: http://review.coreboot.org/6478
Tested-by: build bot (Jenkins)
Reviewed-by: Patrick Georgi <patrick(a)georgi-clan.de>
See http://review.coreboot.org/6478 for details.
-gerrit