diff options
| author | Gerd Hoffmann <kraxel@redhat.com> | 2018-06-26 10:31:19 +0200 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2018-06-26 16:04:01 +0200 |
| commit | 6b9b3c1e303cc0dda99e326031d2b1b612b80e3b (patch) | |
| tree | cb668a3a00718eb8cccecd5905ce3ff3bffbc726 /hw | |
| parent | 93abfc88bd649de1933588bfc7175605331b3ea9 (diff) | |
ramfb: fix overflow
> CID 1393621: (OVERFLOW_BEFORE_WIDEN)
> Potentially overflowing expression "stride * s->height" with type "unsigned
> int" (32 bits, unsigned) is evaluated using +32-bit arithmetic, and then used
> in a context that expects an expression of type "hwaddr" (64 bits, unsigned).
Fix by changing stride from uint32_t to hwaddr.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20180626083120.19515-1-kraxel@redhat.com
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/display/ramfb.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/hw/display/ramfb.c b/hw/display/ramfb.c index 6867bce8ae..30f5c8da20 100644 --- a/hw/display/ramfb.c +++ b/hw/display/ramfb.c @@ -36,8 +36,8 @@ static void ramfb_fw_cfg_write(void *dev, off_t offset, size_t len) { RAMFBState *s = dev; void *framebuffer; - uint32_t stride, fourcc, format; - hwaddr addr, length; + uint32_t fourcc, format; + hwaddr stride, addr, length; s->width = be32_to_cpu(s->cfg.width); s->height = be32_to_cpu(s->cfg.height); |