deepblue/ipmitool
1
0
Fork 0
mirror of https://github.com/ipmitool/ipmitool.git synced 2025-05-10 18:47:22 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

ID:357 - out-of-bound access in DDR4 code

Browse Source 
ID:356 -  DIMM4 Die Count is unreachable
This commit is contained in:
Jim Mankovich 2015-01-01 09:16:34 -07:00
parent 2d66f8d5cf
commit 9811f79eae
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
lib/dimm_spd.c
View File

@ -870,8 +870,8 @@ ipmi_spd_print(uint8_t *spd_data, int len)
uint32_t year; uint32_t year;
uint32_t week; uint32_t week;
if (len < 148) if (len < 348)
return -1; /* we need first 91 bytes to do our thing */ return -1;
/* "Logical rank" referes to the individually addressable die /* "Logical rank" referes to the individually addressable die
* in a 3DS stack and has no meaning for monolithic or * in a 3DS stack and has no meaning for monolithic or
@ -881,7 +881,7 @@ ipmi_spd_print(uint8_t *spd_data, int len)
* rank per package rank. * rank per package rank.
*/ */
lrank_dimm = (spd_data[12]>>3&0x3) + 1; /* Number of Package Ranks per DIMM */ lrank_dimm = (spd_data[12]>>3&0x3) + 1; /* Number of Package Ranks per DIMM */
if ((spd_data[6] & 0x3) == 0x10) { /* 3DS package Type */ if ((spd_data[6] & 0x3) == 0x2) { /* 3DS package Type */
lrank_dimm *= ((spd_data[6]>>4)&0x3) + 1; /* Die Count */ lrank_dimm *= ((spd_data[6]>>4)&0x3) + 1; /* Die Count */
} }
sdram_cap = ldexp(256,(spd_data[4]&15)); sdram_cap = ldexp(256,(spd_data[4]&15));