From 6b9b3c1e303cc0dda99e326031d2b1b612b80e3b Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Tue, 26 Jun 2018 10:31:19 +0200 Subject: [PATCH] ramfb: fix overflow > CID 1393621: (OVERFLOW_BEFORE_WIDEN) > Potentially overflowing expression "stride * s->height" with type "unsigned > int" (32 bits, unsigned) is evaluated using +32-bit arithmetic, and then used > in a context that expects an expression of type "hwaddr" (64 bits, unsigned). Fix by changing stride from uint32_t to hwaddr. Signed-off-by: Gerd Hoffmann Message-id: 20180626083120.19515-1-kraxel@redhat.com --- hw/display/ramfb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/display/ramfb.c b/hw/display/ramfb.c index 6867bce8ae..30f5c8da20 100644 --- a/hw/display/ramfb.c +++ b/hw/display/ramfb.c @@ -36,8 +36,8 @@ static void ramfb_fw_cfg_write(void *dev, off_t offset, size_t len) { RAMFBState *s = dev; void *framebuffer; - uint32_t stride, fourcc, format; - hwaddr addr, length; + uint32_t fourcc, format; + hwaddr stride, addr, length; s->width = be32_to_cpu(s->cfg.width); s->height = be32_to_cpu(s->cfg.height);