diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2017-01-09 16:45:09 +0000 |
|---|---|---|
| committer | Michael Tokarev <mjt@tls.msk.ru> | 2017-01-24 23:26:53 +0300 |
| commit | ba56e4cad41ea2b2fb68d18a632ebc7d4e4b1051 (patch) | |
| tree | 65dd38361a1dfed9072e179c5f40f9de26e0553b /hw/display/framebuffer.c | |
| parent | 1706e9d819ff610154fe47ef3a195c2fd6604efe (diff) | |
hw/display/framebuffer.c: Avoid overflow for framebuffers > 4GB
Coverity points out that calculating src_len by multiplying
src_width by rows could overflow. This can only happen in
the implausible case of a framebuffer larger than 4GB, but
we may as well fix it, placating Coverity. (CID1005515)
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Diffstat (limited to 'hw/display/framebuffer.c')
| -rw-r--r-- | hw/display/framebuffer.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/hw/display/framebuffer.c b/hw/display/framebuffer.c index df51358e72..25aa46c8c7 100644 --- a/hw/display/framebuffer.c +++ b/hw/display/framebuffer.c @@ -78,7 +78,7 @@ void framebuffer_update_display( i = *first_row; *first_row = -1; - src_len = src_width * rows; + src_len = (hwaddr)src_width * rows; mem = mem_section->mr; if (!mem) { |