commit 8a661ed788ff1373015a5c6b705e2e32b63ebe4a
author Edward O'Callaghan <eocallaghan@alterapraxis.com> Wed May 21 09:42:56 2014 +1000
committer Marc Jones <marc.jones@se-eng.com> Wed May 21 01:58:56 2014 +0200
tree 194c9b63601d3eccea99f421840352a543bf28bd
parent 03b00e9675d08d01ff831f20e8e48d19e93494af

amd/cimx/sb?00/SATA.c: Integer overflow in loop condition

The conditional comparison in the for-loop construct with the constant
300000 has an index incrementor of type 'UINT16' (aka 'unsigned short')
which is always true.

Change-Id: I932c168742163be4038728fb40833231a447fa78
Signed-off-by: Edward O'Callaghan <eocallaghan@alterapraxis.com>
Reviewed-on: http://review.coreboot.org/5799
Tested-by: build bot (Jenkins)
Reviewed-by: Marc Jones <marc.jones@se-eng.com>

src/vendorcode/amd/cimx/sb800/SATA.c

diff --git a/src/vendorcode/amd/cimx/sb800/SATA.c b/src/vendorcode/amd/cimx/sb800/SATA.c
index a301208..73f2968 100644
--- a/src/vendorcode/amd/cimx/sb800/SATA.c
+++ b/src/vendorcode/amd/cimx/sb800/SATA.c
@@ -568,7 +568,7 @@
   UINT8   dbPortNum;
   UINT8   dbVar0;
   UINT16   dwIoBase;
-  UINT16   dwVar0;
+  UINT32   dwVar0;
   if ( (pConfig->SataClass == NATIVE_IDE_MODE) || (pConfig->SataClass == LEGACY_IDE_MODE) || (pConfig->SataClass == IDE_TO_AHCI_MODE) ) {
     for ( dbPortNum = 0; dbPortNum < 4; dbPortNum++ ) {
       ReadMEM (*pBar5 + SB_SATA_BAR5_REG128 + dbPortNum * 0x80, AccWidthUint32, &ddVar0);