qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
* [Qemu-devel] [PATCH] macio: fix overflow in lba to offset conversion for ATAPI devices
@ 2016-01-04 17:30 Mark Cave-Ayland
  2016-01-04 19:04 ` P J P
  2016-01-05 21:27 ` John Snow
  0 siblings, 2 replies; 8+ messages in thread
From: Mark Cave-Ayland @ 2016-01-04 17:30 UTC (permalink / raw)
  To: qemu-devel, qemu-ppc, agraf, jsnow

As the IDEState lba field is an int32_t, make sure we cast to int64_t before
shifting to calculate the offset. Otherwise we end up with an overflow when
trying to access sectors beyond 2GB as can occur when using DVD images.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
---
 hw/ide/macio.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/ide/macio.c b/hw/ide/macio.c
index 3ee962f..a78b6e0 100644
--- a/hw/ide/macio.c
+++ b/hw/ide/macio.c
@@ -280,7 +280,7 @@ static void pmac_ide_atapi_transfer_cb(void *opaque, int ret)
     }
 
     /* Calculate current offset */
-    offset = (int64_t)(s->lba << 11) + s->io_buffer_index;
+    offset = ((int64_t)(s->lba) << 11) + s->io_buffer_index;
 
     pmac_dma_read(s->blk, offset, io->len, pmac_ide_atapi_transfer_cb, io);
     return;
-- 
1.7.10.4

^ permalink raw reply related	[flat|nested] 8+ messages in thread

end of thread, other threads:[~2016-01-05 21:27 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-01-04 17:30 [Qemu-devel] [PATCH] macio: fix overflow in lba to offset conversion for ATAPI devices Mark Cave-Ayland
2016-01-04 19:04 ` P J P
2016-01-04 19:15   ` Mark Cave-Ayland
2016-01-04 20:36     ` John Snow
2016-01-04 20:54       ` Mark Cave-Ayland
2016-01-04 21:03         ` John Snow
2016-01-05  8:11           ` Mark Cave-Ayland
2016-01-05 21:27 ` John Snow

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).