[Qemu-devel] [PATCH] ramfb: fix overflow

[Qemu-devel] [PATCH] ramfb: fix overflow

[Gerd Hoffmann]

> CID 1393621:    (OVERFLOW_BEFORE_WIDEN)
> Potentially overflowing expression "stride * s->height" with type "unsigned
> int" (32 bits, unsigned) is evaluated using +32-bit arithmetic, and then used
> in a context that expects an expression of type "hwaddr" (64 bits, unsigned).

Fix by changing stride from uint32_t to hwaddr.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/display/ramfb.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/display/ramfb.c b/hw/display/ramfb.c
index 6867bce8ae..30f5c8da20 100644
--- a/hw/display/ramfb.c
+++ b/hw/display/ramfb.c
@@ -36,8 +36,8 @@ static void ramfb_fw_cfg_write(void *dev, off_t offset, size_t len)
 {
     RAMFBState *s = dev;
     void *framebuffer;
-    uint32_t stride, fourcc, format;
-    hwaddr addr, length;
+    uint32_t fourcc, format;
+    hwaddr stride, addr, length;
 
     s->width  = be32_to_cpu(s->cfg.width);
     s->height = be32_to_cpu(s->cfg.height);
-- 
2.9.3