ramfb: fix overflow
> CID 1393621: (OVERFLOW_BEFORE_WIDEN) > Potentially overflowing expression "stride * s->height" with type "unsigned > int" (32 bits, unsigned) is evaluated using +32-bit arithmetic, and then used > in a context that expects an expression of type "hwaddr" (64 bits, unsigned). Fix by changing stride from uint32_t to hwaddr. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20180626083120.19515-1-kraxel@redhat.com
This commit is contained in:
parent
93abfc88bd
commit
6b9b3c1e30
|
@ -36,8 +36,8 @@ static void ramfb_fw_cfg_write(void *dev, off_t offset, size_t len)
|
||||||
{
|
{
|
||||||
RAMFBState *s = dev;
|
RAMFBState *s = dev;
|
||||||
void *framebuffer;
|
void *framebuffer;
|
||||||
uint32_t stride, fourcc, format;
|
uint32_t fourcc, format;
|
||||||
hwaddr addr, length;
|
hwaddr stride, addr, length;
|
||||||
|
|
||||||
s->width = be32_to_cpu(s->cfg.width);
|
s->width = be32_to_cpu(s->cfg.width);
|
||||||
s->height = be32_to_cpu(s->cfg.height);
|
s->height = be32_to_cpu(s->cfg.height);
|
||||||
|
|
Loading…
Reference in a new issue