On Tue, Jun 30, 2026 at 04:39:39PM +0300, Md Shofiqul Islam wrote:
> errloc stores bit positions of errors returned by decode_bch().
> The maximum number of correctable errors is ecc_bits, so errloc
> must have ecc_bits entries. The array was allocated with data_length
> entries instead, which is the number of EEPROM data bytes -- orders
> of magnitude larger than needed and incorrect.
Good catch, thanks for fixing this.
>
> Fixes: b418dfe16e62 ("board: ge: make VPD code common")
> Signed-off-by: Md Shofiqul Islam <[email protected]>
Reviewed-by: Ian Ray <[email protected]>
> ---
> board/ge/common/vpd_reader.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/board/ge/common/vpd_reader.c b/board/ge/common/vpd_reader.c
> index 2422db38013..b3f9e96615d 100644
> --- a/board/ge/common/vpd_reader.c
> +++ b/board/ge/common/vpd_reader.c
> @@ -66,7 +66,7 @@ static int verify_bch(int ecc_bits, unsigned int prim_poly,
> u8 *data,
> return -1;
> }
>
> - unsigned int *errloc = (unsigned int *)calloc(data_length,
> + unsigned int *errloc = (unsigned int *)calloc(ecc_bits,
> sizeof(unsigned int));
> int errors = decode_bch(bch, data, data_length, ecc, NULL, NULL,
> errloc);
> --
> 2.51.1
>
