* [Qemu-devel] [PATCH 02/18] TCG: fix negative frame offset calculations
@ 2011-05-28 10:06 Blue Swirl
0 siblings, 0 replies; 2+ messages in thread
From: Blue Swirl @ 2011-05-28 10:06 UTC (permalink / raw)
To: qemu-devel
size_t is unsigned, so the frame offset calculations can be incorrect for
negative offsets.
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
---
tcg/tcg.c | 10 +++++++---
1 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/tcg/tcg.c b/tcg/tcg.c
index fad92f9..b31d80d 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1440,13 +1440,17 @@ static void temp_allocate_frame(TCGContext *s, int temp)
{
TCGTemp *ts;
ts = &s->temps[temp];
- s->current_frame_offset = (s->current_frame_offset +
sizeof(tcg_target_long) - 1) & ~(sizeof(tcg_target_long) - 1);
- if (s->current_frame_offset + sizeof(tcg_target_long) > s->frame_end)
+ s->current_frame_offset = (s->current_frame_offset +
+ (tcg_target_long)sizeof(tcg_target_long) - 1) &
+ ~(sizeof(tcg_target_long) - 1);
+ if (s->current_frame_offset + (tcg_target_long)sizeof(tcg_target_long) >
+ s->frame_end) {
tcg_abort();
+ }
ts->mem_offset = s->current_frame_offset;
ts->mem_reg = s->frame_reg;
ts->mem_allocated = 1;
- s->current_frame_offset += sizeof(tcg_target_long);
+ s->current_frame_offset += (tcg_target_long)sizeof(tcg_target_long);
}
/* free register 'reg' by spilling the corresponding temporary if necessary */
--
1.6.2.4
^ permalink raw reply related [flat|nested] 2+ messages in thread* [Qemu-devel] [PATCH 02/18] TCG: fix negative frame offset calculations
@ 2011-06-19 21:04 Blue Swirl
0 siblings, 0 replies; 2+ messages in thread
From: Blue Swirl @ 2011-06-19 21:04 UTC (permalink / raw)
To: qemu-devel
size_t is unsigned, so the frame offset calculations can be incorrect for
negative offsets.
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
---
tcg/tcg.c | 10 +++++++---
1 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/tcg/tcg.c b/tcg/tcg.c
index debf47f..d8bf721 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1439,13 +1439,17 @@ static void temp_allocate_frame(TCGContext *s, int temp)
{
TCGTemp *ts;
ts = &s->temps[temp];
- s->current_frame_offset = (s->current_frame_offset +
sizeof(tcg_target_long) - 1) & ~(sizeof(tcg_target_long) - 1);
- if (s->current_frame_offset + sizeof(tcg_target_long) > s->frame_end)
+ s->current_frame_offset = (s->current_frame_offset +
+ (tcg_target_long)sizeof(tcg_target_long) - 1) &
+ ~(sizeof(tcg_target_long) - 1);
+ if (s->current_frame_offset + (tcg_target_long)sizeof(tcg_target_long) >
+ s->frame_end) {
tcg_abort();
+ }
ts->mem_offset = s->current_frame_offset;
ts->mem_reg = s->frame_reg;
ts->mem_allocated = 1;
- s->current_frame_offset += sizeof(tcg_target_long);
+ s->current_frame_offset += (tcg_target_long)sizeof(tcg_target_long);
}
/* free register 'reg' by spilling the corresponding temporary if necessary */
--
1.6.2.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2011-06-19 21:05 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-05-28 10:06 [Qemu-devel] [PATCH 02/18] TCG: fix negative frame offset calculations Blue Swirl
-- strict thread matches above, loose matches on Subject: below --
2011-06-19 21:04 Blue Swirl
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).