[Qemu-devel] [PATCH] Fix overflow in i440fx_init()

[Qemu-devel] [PATCH] Fix overflow in i440fx_init()

[Avi Kivity]

The ram_size parameter can be larger than an int, so it may be truncated.

Fix by using the correct type.

Signed-off-by: Avi Kivity <avi@redhat.com>
---
 hw/pc.h       |    2 +-
 hw/piix_pci.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/pc.h b/hw/pc.h
index e57821a..4898b37 100644
--- a/hw/pc.h
+++ b/hw/pc.h
@@ -115,7 +115,7 @@ int pcspk_audio_init(qemu_irq *pic);
 struct PCII440FXState;
 typedef struct PCII440FXState PCII440FXState;
 
-PCIBus *i440fx_init(PCII440FXState **pi440fx_state, int *piix_devfn, qemu_irq *pic, int ram_size);
+PCIBus *i440fx_init(PCII440FXState **pi440fx_state, int *piix_devfn, qemu_irq *pic, ram_addr_t ram_size);
 void i440fx_set_smm(PCII440FXState *d, int val);
 void i440fx_init_memory_mappings(PCII440FXState *d);
 
diff --git a/hw/piix_pci.c b/hw/piix_pci.c
index 625fc1c..2e44b78 100644
--- a/hw/piix_pci.c
+++ b/hw/piix_pci.c
@@ -220,7 +220,7 @@ static int i440fx_initfn(PCIDevice *dev)
 
 static PIIX3State *piix3_dev;
 
-PCIBus *i440fx_init(PCII440FXState **pi440fx_state, int *piix3_devfn, qemu_irq *pic, int ram_size)
+PCIBus *i440fx_init(PCII440FXState **pi440fx_state, int *piix3_devfn, qemu_irq *pic, ram_addr_t ram_size)
 {
     DeviceState *dev;
     PCIBus *b;
-- 
1.7.0.4

Re: [Qemu-devel] [PATCH] Fix overflow in i440fx_init()

[Aurelien Jarno]

On Sun, May 09, 2010 at 02:51:13PM +0300, Avi Kivity wrote:
> The ram_size parameter can be larger than an int, so it may be truncated.
> 
> Fix by using the correct type.

Thanks, applied.

> Signed-off-by: Avi Kivity <avi@redhat.com>
> ---
>  hw/pc.h       |    2 +-
>  hw/piix_pci.c |    2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/pc.h b/hw/pc.h
> index e57821a..4898b37 100644
> --- a/hw/pc.h
> +++ b/hw/pc.h
> @@ -115,7 +115,7 @@ int pcspk_audio_init(qemu_irq *pic);
>  struct PCII440FXState;
>  typedef struct PCII440FXState PCII440FXState;
>  
> -PCIBus *i440fx_init(PCII440FXState **pi440fx_state, int *piix_devfn, qemu_irq *pic, int ram_size);
> +PCIBus *i440fx_init(PCII440FXState **pi440fx_state, int *piix_devfn, qemu_irq *pic, ram_addr_t ram_size);
>  void i440fx_set_smm(PCII440FXState *d, int val);
>  void i440fx_init_memory_mappings(PCII440FXState *d);
>  
> diff --git a/hw/piix_pci.c b/hw/piix_pci.c
> index 625fc1c..2e44b78 100644
> --- a/hw/piix_pci.c
> +++ b/hw/piix_pci.c
> @@ -220,7 +220,7 @@ static int i440fx_initfn(PCIDevice *dev)
>  
>  static PIIX3State *piix3_dev;
>  
> -PCIBus *i440fx_init(PCII440FXState **pi440fx_state, int *piix3_devfn, qemu_irq *pic, int ram_size)
> +PCIBus *i440fx_init(PCII440FXState **pi440fx_state, int *piix3_devfn, qemu_irq *pic, ram_addr_t ram_size)
>  {
>      DeviceState *dev;
>      PCIBus *b;
> -- 
> 1.7.0.4
> 
> 
> 
> 

-- 
Aurelien Jarno                          GPG: 1024D/F1BCDB73
aurelien@aurel32.net                 http://www.aurel32.net