qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH] fix Coverity scan SIGN_EXTENSION error


From: Laszlo Ersek
Subject: Re: [Qemu-devel] [PATCH] fix Coverity scan SIGN_EXTENSION error
Date: Thu, 06 Jun 2013 20:52:06 +0200
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130513 Thunderbird/17.0.6

On 06/06/13 17:12, Gerd Hoffmann wrote:
> Cc: Markus Armbruster <address@hidden>
> Signed-off-by: Gerd Hoffmann <address@hidden>
> ---
>  hw/display/qxl-render.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c
> index f511a62..269b1a7 100644
> --- a/hw/display/qxl-render.c
> +++ b/hw/display/qxl-render.c
> @@ -199,7 +199,7 @@ static QEMUCursor *qxl_cursor(PCIQXLDevice *qxl, 
> QXLCursor *cursor)
>      c->hot_y = cursor->header.hot_spot_y;
>      switch (cursor->header.type) {
>      case SPICE_CURSOR_TYPE_ALPHA:
> -        size = cursor->header.width * cursor->header.height * 
> sizeof(uint32_t);
> +        size = sizeof(uint32_t) * cursor->header.width * 
> cursor->header.height;
>          memcpy(c->data, cursor->chunk.data, size);
>          if (qxl->debug > 2) {
>              cursor_print_ascii_art(c, "qxl/alpha");
> 

Right. "width" and "height" are both "uint16_t" (short unsigned) and
they are promoted to "int". The binding is then

  (int * int) * size_t
  int         * size_t
  size_t      * size_t
  size_t

By the time the product would be converted to size_t ("unsigned" or
"unsigned long" in practice, dependent on ILP32 or LP64), it may have
overflowed (undefined behavior for signed int).

The above changes it to

  (size_t * int)    * int
  (size_t * size_t) * int
  size_t            * int
  size_t            * size_t
  size_t

(BTW this is not order of evaluation, just how the types are determined
by operator binding.)

Reviewed-by: Laszlo Ersek <address@hidden>




reply via email to

[Prev in Thread] Current Thread [Next in Thread]