Commit 6b9b3c1e authored by Gerd Hoffmann's avatar Gerd Hoffmann
Browse files

ramfb: fix overflow 



> CID 1393621:    (OVERFLOW_BEFORE_WIDEN)
> Potentially overflowing expression "stride * s->height" with type "unsigned
> int" (32 bits, unsigned) is evaluated using +32-bit arithmetic, and then used
> in a context that expects an expression of type "hwaddr" (64 bits, unsigned).

Fix by changing stride from uint32_t to hwaddr.

Signed-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
Message-id: 20180626083120.19515-1-kraxel@redhat.com
parent 93abfc88

hw/display/ramfb.c

+2 −2
Original line number Diff line number Diff line
@@ -36,8 +36,8 @@ static void ramfb_fw_cfg_write(void *dev, off_t offset, size_t len) 
{

    RAMFBState *s = dev;

    void *framebuffer;

    uint32_t stride, fourcc, format;

    hwaddr addr, length;

    uint32_t fourcc, format;

    hwaddr stride, addr, length;



    s->width  = be32_to_cpu(s->cfg.width);

    s->height = be32_to_cpu(s->cfg.height);