From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58973) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YbSvZ-0003eM-O4 for qemu-devel@nongnu.org; Fri, 27 Mar 2015 07:59:54 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YbSvV-0006nb-MQ for qemu-devel@nongnu.org; Fri, 27 Mar 2015 07:59:53 -0400 Received: from mx1.redhat.com ([209.132.183.28]:42563) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YbSvV-0006mC-IL for qemu-devel@nongnu.org; Fri, 27 Mar 2015 07:59:49 -0400 From: Stefan Hajnoczi Date: Fri, 27 Mar 2015 11:59:44 +0000 Message-Id: <1427457584-9179-2-git-send-email-stefanha@redhat.com> In-Reply-To: <1427457584-9179-1-git-send-email-stefanha@redhat.com> References: <1427457584-9179-1-git-send-email-stefanha@redhat.com> Subject: [Qemu-devel] [RESEND PULL for-2.3 1/1] hw/net/e1000: fix integer endianness List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Peter Maydell , Shannon Zhao , Stefan Hajnoczi , Shannon Zhao From: Shannon Zhao It's detected by coverity.In is_vlan_packet s->mac_reg[VET] is unsigned int but is dereferenced as a narrower unsigned short. This may lead to unexpected results depending on machine endianness. Signed-off-by: Shannon Zhao Signed-off-by: Shannon Zhao Message-id: 1426224119-8352-1-git-send-email-zhaoshenglong@huawei.com Signed-off-by: Stefan Hajnoczi --- hw/net/e1000.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/net/e1000.c b/hw/net/e1000.c index 3405cb9..091d61a 100644 --- a/hw/net/e1000.c +++ b/hw/net/e1000.c @@ -578,7 +578,7 @@ static inline int is_vlan_packet(E1000State *s, const uint8_t *buf) { return (be16_to_cpup((uint16_t *)(buf + 12)) == - le16_to_cpup((uint16_t *)(s->mac_reg + VET))); + le16_to_cpu(s->mac_reg[VET])); } static inline int @@ -711,7 +711,7 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp) (tp->cptse || txd_lower & E1000_TXD_CMD_EOP)) { tp->vlan_needed = 1; stw_be_p(tp->vlan_header, - le16_to_cpup((uint16_t *)(s->mac_reg + VET))); + le16_to_cpu(s->mac_reg[VET])); stw_be_p(tp->vlan_header + 2, le16_to_cpu(dp->upper.fields.special)); } -- 2.1.0