mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ramfb: fix overflow

Browse Source 
> CID 1393621:    (OVERFLOW_BEFORE_WIDEN)
> Potentially overflowing expression "stride * s->height" with type "unsigned
> int" (32 bits, unsigned) is evaluated using +32-bit arithmetic, and then used
> in a context that expects an expression of type "hwaddr" (64 bits, unsigned).

Fix by changing stride from uint32_t to hwaddr.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20180626083120.19515-1-kraxel@redhat.com
This commit is contained in:
Gerd Hoffmann 2018-06-26 10:31:19 +02:00
parent 93abfc88bd
commit 6b9b3c1e30
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
hw/display/ramfb.c
View File

@ -36,8 +36,8 @@ static void ramfb_fw_cfg_write(void *dev, off_t offset, size_t len)
{
RAMFBState *s = dev;
void *framebuffer;
uint32_t stride, fourcc, format;
hwaddr addr, length;
uint32_t fourcc, format;
hwaddr stride, addr, length;
s->width = be32_to_cpu(s->cfg.width);
s->height = be32_to_cpu(s->cfg.height);