Paul Menzel (paulepanter(a)users.sourceforge.net) just uploaded a new patch set to gerrit, which you can find at http://review.coreboot.org/6487
-gerrit
commit f9061cf60cf79c156aa713d3325529688ae2f7b0
Author: Paul Menzel <paulepanter(a)users.sourceforge.net>
Date: Mon Aug 4 08:22:39 2014 +0200
util/sconfig/main.c: Free memory pointed to by `outputc`
Cppcheck 1.65 reports the error below.
[main.c:709]: (error) Memory leak: outputc
So free the memory space pointed to by `outputc` to fix the memory
leak.
Change-Id: I1767cd15380832a93cc79fb515861982e3f1ee94
Signed-off-by: Paul Menzel <paulepanter(a)users.sourceforge.net>
---
util/sconfig/main.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/util/sconfig/main.c b/util/sconfig/main.c
index 6295e01..90ceda2 100644
--- a/util/sconfig/main.c
+++ b/util/sconfig/main.c
@@ -629,9 +629,11 @@ int main(int argc, char** argv) {
FILE *autogen = fopen(outputc, "w");
if (!autogen) {
fprintf(stderr, "Could not open file '%s' for writing: ", outputc);
+ free(outputc);
perror(NULL);
exit(1);
}
+ free(outputc);
struct header *h;
if (scan_mode == STATIC_MODE) {
Paul Menzel (paulepanter(a)users.sourceforge.net) just uploaded a new patch set to gerrit, which you can find at http://review.coreboot.org/6486
-gerrit
commit 0162234401f52cc13c5cf2edf501047b45977e83
Author: Paul Menzel <paulepanter(a)users.sourceforge.net>
Date: Mon Aug 4 08:15:03 2014 +0200
util/sconfig/main.c: Free memory pointed to by `devtree`
Cppcheck 1.65 reports the error below.
[main.c:709]: (error) Memory leak: devtree
So free the memory space pointed to by `devtree` to fix the memory
leak.
Change-Id: Ibcd93057e88544ea900d9b6261c907baa751b2f1
Signed-off-by: Paul Menzel <paulepanter(a)users.sourceforge.net>
---
util/sconfig/main.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/util/sconfig/main.c b/util/sconfig/main.c
index 44d4911..6295e01 100644
--- a/util/sconfig/main.c
+++ b/util/sconfig/main.c
@@ -606,9 +606,11 @@ int main(int argc, char** argv) {
FILE *filec = fopen(devtree, "r");
if (!filec) {
fprintf(stderr, "Could not open file '%s' for reading: ", devtree);
+ free(devtree);
perror(NULL);
exit(1);
}
+ free(devtree);
yyrestart(filec);
the following patch was just integrated into master:
commit 1f68880e50a2b847838bbdc6916484f9fd86a681
Author: Patrick Georgi <patrick(a)georgi-clan.de>
Date: Sun Aug 3 15:51:19 2014 +0200
sconfig: more careful string resource handling
When parsing a string to numbers, we don't need to copy it.
And when creating strings, we should eventually free them.
Change-Id: I9023fef6e97a1830bc68502be32e79879c1617d4
Found-By: Coverity Scan
Signed-off-by: Patrick Georgi <patrick(a)georgi-clan.de>
Reviewed-on: http://review.coreboot.org/6484
Tested-by: build bot (Jenkins)
Reviewed-by: Edward O'Callaghan <eocallaghan(a)alterapraxis.com>
See http://review.coreboot.org/6484 for details.
-gerrit
Edward O'Callaghan (eocallaghan(a)alterapraxis.com) just uploaded a new patch set to gerrit, which you can find at http://review.coreboot.org/6478
-gerrit
commit a5560ea8ad27cc8a8f2631ec9766ddbd402e54cb
Author: Edward O'Callaghan <eocallaghan(a)alterapraxis.com>
Date: Sun Aug 3 20:00:47 2014 +1000
cpu/intel: Fix out-of-bounds read due to off-by-one in condition
If power_limit_1_time > 129 is false then power_limit_1_time can have a
value of up to 129 leading to an out-of-bounds illegal read indexing the
power_limit_time_sec_to_msr[] array. Thankfully all call sites have been
doing the right thing up until now so the issue has not been visible.
Change-Id: Ic029d1af7fe43ca7da271043c2b08fe3088714af
Found-by: Coverity Scan
Signed-off-by: Edward O'Callaghan <eocallaghan(a)alterapraxis.com>
---
src/cpu/intel/fsp_model_206ax/model_206ax_init.c | 2 +-
src/cpu/intel/haswell/haswell_init.c | 4 ++--
src/cpu/intel/model_206ax/model_206ax_init.c | 2 +-
3 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/src/cpu/intel/fsp_model_206ax/model_206ax_init.c b/src/cpu/intel/fsp_model_206ax/model_206ax_init.c
index c2f9f19..ac1880a 100644
--- a/src/cpu/intel/fsp_model_206ax/model_206ax_init.c
+++ b/src/cpu/intel/fsp_model_206ax/model_206ax_init.c
@@ -156,7 +156,7 @@ void set_power_limits(u8 power_limit_1_time)
unsigned tdp, min_power, max_power, max_time;
u8 power_limit_1_val;
- if (power_limit_1_time > ARRAY_SIZE(power_limit_time_sec_to_msr))
+ if (power_limit_1_time >= ARRAY_SIZE(power_limit_time_sec_to_msr))
return;
if (!(msr.lo & PLATFORM_INFO_SET_TDP))
diff --git a/src/cpu/intel/haswell/haswell_init.c b/src/cpu/intel/haswell/haswell_init.c
index 043ba3a..68c7643 100644
--- a/src/cpu/intel/haswell/haswell_init.c
+++ b/src/cpu/intel/haswell/haswell_init.c
@@ -463,8 +463,8 @@ void set_power_limits(u8 power_limit_1_time)
unsigned tdp, min_power, max_power, max_time;
u8 power_limit_1_val;
- if (power_limit_1_time > ARRAY_SIZE(power_limit_time_sec_to_msr))
- power_limit_1_time = 28;
+ if (power_limit_1_time >= ARRAY_SIZE(power_limit_time_sec_to_msr))
+ power_limit_1_time = ARRAY_SIZE(power_limit_time_sec_to_msr) - 1;
if (!(msr.lo & PLATFORM_INFO_SET_TDP))
return;
diff --git a/src/cpu/intel/model_206ax/model_206ax_init.c b/src/cpu/intel/model_206ax/model_206ax_init.c
index 4e56414..dbde512 100644
--- a/src/cpu/intel/model_206ax/model_206ax_init.c
+++ b/src/cpu/intel/model_206ax/model_206ax_init.c
@@ -247,7 +247,7 @@ void set_power_limits(u8 power_limit_1_time)
unsigned tdp, min_power, max_power, max_time;
u8 power_limit_1_val;
- if (power_limit_1_time > ARRAY_SIZE(power_limit_time_sec_to_msr))
+ if (power_limit_1_time >= ARRAY_SIZE(power_limit_time_sec_to_msr))
return;
if (!(msr.lo & PLATFORM_INFO_SET_TDP))
Patrick Georgi (patrick(a)georgi-clan.de) just uploaded a new patch set to gerrit, which you can find at http://review.coreboot.org/6484
-gerrit
commit 927a150faf917b5b9da5406d9b9356702a5a001f
Author: Patrick Georgi <patrick(a)georgi-clan.de>
Date: Sun Aug 3 15:51:19 2014 +0200
sconfig: more careful string resource handling
When parsing a string to numbers, we don't need to copy it.
And when creating strings, we should eventually free them.
Change-Id: I9023fef6e97a1830bc68502be32e79879c1617d4
Found-By: Coverity Scan
Signed-off-by: Patrick Georgi <patrick(a)georgi-clan.de>
---
util/sconfig/main.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/util/sconfig/main.c b/util/sconfig/main.c
index 20471de..ce39a11 100644
--- a/util/sconfig/main.c
+++ b/util/sconfig/main.c
@@ -195,6 +195,7 @@ struct device *new_chip(struct device *parent, struct device *bus, char *path) {
parent->latestchild = new_chip;
if (!parent->children)
parent->children = new_chip;
+ free(chip_h);
return new_chip;
}
@@ -225,7 +226,7 @@ struct device *new_device(struct device *parent, struct device *busdev, const in
new_d->bustype = bus;
char *tmp;
- new_d->path_a = strtol(strdup(devnum), &tmp, 16);
+ new_d->path_a = strtol(devnum, &tmp, 16);
if (*tmp == '.') {
tmp++;
new_d->path_b = strtol(tmp, NULL, 16);
the following patch was just integrated into master:
commit 55391c422f8c45e40bb014d238769501aed65d56
Author: Vladimir Serbinenko <phcoder(a)gmail.com>
Date: Sun Aug 3 14:51:00 2014 +0200
nehalem: Make UMA size configurable in CMOS.
All modes tested on X201.
Change-Id: I23df81523196ea3f5fdb10eb04f4496c00aaeb9f
Signed-off-by: Vladimir Serbinenko <phcoder(a)gmail.com>
Reviewed-on: http://review.coreboot.org/6481
Tested-by: build bot (Jenkins)
Reviewed-by: Patrick Georgi <patrick(a)georgi-clan.de>
See http://review.coreboot.org/6481 for details.
-gerrit
Edward O'Callaghan (eocallaghan(a)alterapraxis.com) just uploaded a new patch set to gerrit, which you can find at http://review.coreboot.org/6473
-gerrit
commit 5bad85ac4bcdab72ad8aee2ae31ecc4f1924df0a
Author: Edward O'Callaghan <eocallaghan(a)alterapraxis.com>
Date: Sun Aug 3 23:38:17 2014 +1000
northbridge/intel: Out of bounds write to array in gma.h
The signature[] array in the mailbox struct opregion_header_t has
IGD_OPREGION_SIGNATURE written to it with a
sizeof(IGD_OPREGION_SIGNATURE) and not a sizeof(signature[]). This
resulted in a silent off-by-one out of bounds illegal write.
Change-Id: I651620a753c743dd2ed2af51c012c27c14a5ea25
Found-by: Coverity Scan
Signed-off-by: Edward O'Callaghan <eocallaghan(a)alterapraxis.com>
---
src/northbridge/intel/fsp_sandybridge/acpi.c | 2 +-
src/northbridge/intel/haswell/acpi.c | 2 +-
src/northbridge/intel/nehalem/acpi.c | 2 +-
src/northbridge/intel/sandybridge/acpi.c | 2 +-
4 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/src/northbridge/intel/fsp_sandybridge/acpi.c b/src/northbridge/intel/fsp_sandybridge/acpi.c
index 3e47ed4..faef4d7 100644
--- a/src/northbridge/intel/fsp_sandybridge/acpi.c
+++ b/src/northbridge/intel/fsp_sandybridge/acpi.c
@@ -142,7 +142,7 @@ int init_igd_opregion(igd_opregion_t *opregion)
// FIXME if IGD is disabled, we should exit here.
memcpy(&opregion->header.signature, IGD_OPREGION_SIGNATURE,
- sizeof(IGD_OPREGION_SIGNATURE));
+ sizeof(opregion->header.signature));
/* 8kb */
opregion->header.size = sizeof(igd_opregion_t) / 1024;
diff --git a/src/northbridge/intel/haswell/acpi.c b/src/northbridge/intel/haswell/acpi.c
index 964a9d3..b2fab11 100644
--- a/src/northbridge/intel/haswell/acpi.c
+++ b/src/northbridge/intel/haswell/acpi.c
@@ -140,7 +140,7 @@ int init_igd_opregion(igd_opregion_t *opregion)
// FIXME if IGD is disabled, we should exit here.
memcpy(&opregion->header.signature, IGD_OPREGION_SIGNATURE,
- sizeof(IGD_OPREGION_SIGNATURE));
+ sizeof(opregion->header.signature));
/* 8kb */
opregion->header.size = sizeof(igd_opregion_t) / 1024;
diff --git a/src/northbridge/intel/nehalem/acpi.c b/src/northbridge/intel/nehalem/acpi.c
index 077ceda..0ede237 100644
--- a/src/northbridge/intel/nehalem/acpi.c
+++ b/src/northbridge/intel/nehalem/acpi.c
@@ -139,7 +139,7 @@ int init_igd_opregion(igd_opregion_t * opregion)
// FIXME if IGD is disabled, we should exit here.
memcpy(&opregion->header.signature, IGD_OPREGION_SIGNATURE,
- sizeof(IGD_OPREGION_SIGNATURE));
+ sizeof(opregion->header.signature));
/* 8kb */
opregion->header.size = sizeof(igd_opregion_t) / 1024;
diff --git a/src/northbridge/intel/sandybridge/acpi.c b/src/northbridge/intel/sandybridge/acpi.c
index 398cb30..58e3b54 100644
--- a/src/northbridge/intel/sandybridge/acpi.c
+++ b/src/northbridge/intel/sandybridge/acpi.c
@@ -142,7 +142,7 @@ int init_igd_opregion(igd_opregion_t *opregion)
// FIXME if IGD is disabled, we should exit here.
memcpy(&opregion->header.signature, IGD_OPREGION_SIGNATURE,
- sizeof(IGD_OPREGION_SIGNATURE));
+ sizeof(opregion->header.signature));
/* 8kb */
opregion->header.size = sizeof(igd_opregion_t) / 1024;
Patrick Georgi (patrick(a)georgi-clan.de) just uploaded a new patch set to gerrit, which you can find at http://review.coreboot.org/6483
-gerrit
commit 2b2169fdb7784ea92020a486d32003afdef463d3
Author: Patrick Georgi <patrick(a)georgi-clan.de>
Date: Sun Aug 3 15:27:35 2014 +0200
sconfig: improve argument parsing
Running sconfig with four arguments where the third
does not match /-./ made sconfig use uninitialized
memory to build the output filename.
Change-Id: If4a147ff23771ca9b6a913605af60249be1ca3d0
Found-By: Coverity Scan
Signed-off-by: Patrick Georgi <patrick(a)georgi-clan.de>
---
util/sconfig/main.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/util/sconfig/main.c b/util/sconfig/main.c
index f6ec0e2..20471de 100644
--- a/util/sconfig/main.c
+++ b/util/sconfig/main.c
@@ -570,7 +570,10 @@ int main(int argc, char** argv) {
scan_mode = STATIC_MODE;
outputc=malloc(strlen(outputdir)+20);
sprintf(outputc, "%s/static.c", outputdir);
- } else if ((argc == 5) && (argv[3][0] == '-') && (argv[3][2] == 0)) {
+ } else if (argc == 5) {
+ if ((argv[3][0] != '-') || (argv[3][2] == 0)) {
+ usage();
+ }
switch (argv[3][1]) {
case 's':