From: zeff@altlinux.org
To: qemu-devel@nongnu.org
Cc: mark.cave-ayland@ilande.co.uk, atar4qemu@gmail.com,
peter.maydell@linaro.org, sdl.qemu@linuxtesting.org,
e.bykhanova@fobos-nt.ru, sergeevdv@basealt.ru,
Denis Sergeev <zeff@altlinux.org>
Subject: [sdl-qemu] [PATCH] disas/sparc: Fix integer overflow in compare_opcodes()
Date: Tue, 18 Feb 2025 11:58:35 +0300 [thread overview]
Message-ID: <20250218085835.64928-1-zeff@altlinux.org> (raw)
From: Denis Sergeev <zeff@altlinux.org>
Fix an integer overflow issue caused by a left shift operation (1 << i)
on an int literal. For i >= 31, this could lead to undefined behavior by
exceeding the 32-bit range.
To prevent this, explicitly cast the literal to an unsigned long int
(1UL << i), ensuring the shift operation is performed safely.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2618
Reported-by: E. Bykhanova <e.bykhanova@fobos-nt.ru>
Signed-off-by: Denis Sergeev <zeff@altlinux.org>
---
disas/sparc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/disas/sparc.c b/disas/sparc.c
index 5689533ce1..92b9ac754f 100644
--- a/disas/sparc.c
+++ b/disas/sparc.c
@@ -2515,7 +2515,7 @@ compare_opcodes (const void * a, const void * b)
another, it is important to order the opcodes in the right order. */
for (i = 0; i < 32; ++i)
{
- unsigned long int x = 1 << i;
+ unsigned long int x = 1UL << i;
int x0 = (match0 & x) != 0;
int x1 = (match1 & x) != 0;
@@ -2525,7 +2525,7 @@ compare_opcodes (const void * a, const void * b)
for (i = 0; i < 32; ++i)
{
- unsigned long int x = 1 << i;
+ unsigned long int x = 1UL << i;
int x0 = (lose0 & x) != 0;
int x1 = (lose1 & x) != 0;
--
2.42.4
next reply other threads:[~2025-02-18 14:06 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-02-18 8:58 zeff [this message]
2025-02-18 10:28 ` [sdl-qemu] [PATCH] disas/sparc: Fix integer overflow in compare_opcodes() Peter Maydell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250218085835.64928-1-zeff@altlinux.org \
--to=zeff@altlinux.org \
--cc=atar4qemu@gmail.com \
--cc=e.bykhanova@fobos-nt.ru \
--cc=mark.cave-ayland@ilande.co.uk \
--cc=peter.maydell@linaro.org \
--cc=qemu-devel@nongnu.org \
--cc=sdl.qemu@linuxtesting.org \
--cc=sergeevdv@basealt.ru \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.