[Qemu-devel] [PATCH] Fix overflow in i440fx_init()

[Avi Kivity <avi@redhat.com>]

The ram_size parameter can be larger than an int, so it may be truncated.

Fix by using the correct type.

Signed-off-by: Avi Kivity <avi@redhat.com>
---
 hw/pc.h       |    2 +-
 hw/piix_pci.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/pc.h b/hw/pc.h
index e57821a..4898b37 100644
--- a/hw/pc.h
+++ b/hw/pc.h
@@ -115,7 +115,7 @@ int pcspk_audio_init(qemu_irq *pic);
 struct PCII440FXState;
 typedef struct PCII440FXState PCII440FXState;
 
-PCIBus *i440fx_init(PCII440FXState **pi440fx_state, int *piix_devfn, qemu_irq *pic, int ram_size);
+PCIBus *i440fx_init(PCII440FXState **pi440fx_state, int *piix_devfn, qemu_irq *pic, ram_addr_t ram_size);
 void i440fx_set_smm(PCII440FXState *d, int val);
 void i440fx_init_memory_mappings(PCII440FXState *d);
 
diff --git a/hw/piix_pci.c b/hw/piix_pci.c
index 625fc1c..2e44b78 100644
--- a/hw/piix_pci.c
+++ b/hw/piix_pci.c
@@ -220,7 +220,7 @@ static int i440fx_initfn(PCIDevice *dev)
 
 static PIIX3State *piix3_dev;
 
-PCIBus *i440fx_init(PCII440FXState **pi440fx_state, int *piix3_devfn, qemu_irq *pic, int ram_size)
+PCIBus *i440fx_init(PCII440FXState **pi440fx_state, int *piix3_devfn, qemu_irq *pic, ram_addr_t ram_size)
 {
     DeviceState *dev;
     PCIBus *b;
-- 
1.7.0.4