diff options
| author | Martin Roth <gaumless@gmail.com> | 2023-10-23 17:10:29 -0600 |
|---|---|---|
| committer | Felix Held <felix-coreboot@felixheld.de> | 2023-10-25 14:07:16 +0000 |
| commit | a41abea65d673d7c006dbde2ca832abdedd0bb2b (patch) | |
| tree | b81d5d6cd27c1d23393e5ef678e8b41ca19961e0 /src/device | |
| parent | 58964ff02ce7a78bc698f424fd0834aad930e1af (diff) | |
| download | coreboot-a41abea65d673d7c006dbde2ca832abdedd0bb2b.tar.gz coreboot-a41abea65d673d7c006dbde2ca832abdedd0bb2b.tar.bz2 coreboot-a41abea65d673d7c006dbde2ca832abdedd0bb2b.zip | |
device/dram/ddr3.c: Check SPD byte before using as a divisor
The Medium Time Base (MTB) value is calculated by dividing one SPD
byte by another. Return an error if the divisor is zero before using
the value for division.
Found-by: Coverity Scan #1469303
Signed-off-by: Martin Roth <gaumless@gmail.com>
Change-Id: Ic0a70291c42b5c2d21d65de92487b2dd88609983
Reviewed-on: https://review.coreboot.org/c/coreboot/+/78613
Reviewed-by: Patrick Rudolph <patrick.rudolph@9elements.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Felix Singer <service+coreboot-gerrit@felixsinger.de>
Diffstat (limited to 'src/device')
| -rw-r--r-- | src/device/dram/ddr3.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/device/dram/ddr3.c b/src/device/dram/ddr3.c index 9e11ab57cc06..1fa3f4c3b2ba 100644 --- a/src/device/dram/ddr3.c +++ b/src/device/dram/ddr3.c @@ -422,6 +422,8 @@ int spd_xmp_decode_ddr3(struct dimm_attr_ddr3_st *dimm, spd_raw_data spd, /* Medium Timebase = * Medium Timebase (MTB) Dividend / * Medium Timebase (MTB) Divisor */ + if (spd[181] == 0) // Avoid dividing by zero. + return SPD_STATUS_INVALID; mtb = (((u32)spd[180]) << 8) / spd[181]; dimm->dimms_per_channel = ((spd[178] >> 2) & 0x3) + 1; @@ -437,6 +439,8 @@ int spd_xmp_decode_ddr3(struct dimm_attr_ddr3_st *dimm, spd_raw_data spd, /* Medium Timebase = * Medium Timebase (MTB) Dividend / * Medium Timebase (MTB) Divisor */ + if (spd[183] == 0) // Avoid dividing by zero. + return SPD_STATUS_INVALID; mtb = (((u32)spd[182]) << 8) / spd[183]; dimm->dimms_per_channel = ((spd[178] >> 4) & 0x3) + 1; |