From: Blue Swirl <blauwirbel@gmail.com>
To: qemu-devel <qemu-devel@nongnu.org>
Subject: [Qemu-devel] [PATCH 05/11] TCG: fix negative frame offset calculations
Date: Sat, 14 May 2011 22:38:16 +0300 [thread overview]
Message-ID: <BANLkTimtarbmim0dnOr3YwgjRSLr6bRmyw@mail.gmail.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 1294 bytes --]
size_t is unsigned, so the frame offset calculations can be incorrect for
negative offsets.
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
---
tcg/tcg.c | 10 +++++++---
1 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 8748c05..75972c3 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1434,13 +1434,17 @@ static void temp_allocate_frame(TCGContext *s, int temp)
{
TCGTemp *ts;
ts = &s->temps[temp];
- s->current_frame_offset = (s->current_frame_offset +
sizeof(tcg_target_long) - 1) & ~(sizeof(tcg_target_long) - 1);
- if (s->current_frame_offset + sizeof(tcg_target_long) > s->frame_end)
+ s->current_frame_offset = (s->current_frame_offset +
+ (tcg_target_long)sizeof(tcg_target_long) - 1) &
+ ~(sizeof(tcg_target_long) - 1);
+ if (s->current_frame_offset + (tcg_target_long)sizeof(tcg_target_long) >
+ s->frame_end) {
tcg_abort();
+ }
ts->mem_offset = s->current_frame_offset;
ts->mem_reg = s->frame_reg;
ts->mem_allocated = 1;
- s->current_frame_offset += sizeof(tcg_target_long);
+ s->current_frame_offset += (tcg_target_long)sizeof(tcg_target_long);
}
/* free register 'reg' by spilling the corresponding temporary if necessary */
--
1.6.2.4
[-- Attachment #2: 0005-TCG-fix-negative-frame-offset-calculations.patch --]
[-- Type: text/x-diff, Size: 1787 bytes --]
From 13a409bacd4862293c4d65e8bef662779e5a0e47 Mon Sep 17 00:00:00 2001
Message-Id: <13a409bacd4862293c4d65e8bef662779e5a0e47.1305401750.git.blauwirbel@gmail.com>
In-Reply-To: <6e21df8e369388a3152dcc7da30431c672e1ee37.1305401750.git.blauwirbel@gmail.com>
References: <6e21df8e369388a3152dcc7da30431c672e1ee37.1305401750.git.blauwirbel@gmail.com>
From: Blue Swirl <blauwirbel@gmail.com>
Date: Sat, 14 May 2011 14:03:22 +0000
Subject: [PATCH 05/11] TCG: fix negative frame offset calculations
size_t is unsigned, so the frame offset calculations can be incorrect for
negative offsets.
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
---
tcg/tcg.c | 10 +++++++---
1 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 8748c05..75972c3 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1434,13 +1434,17 @@ static void temp_allocate_frame(TCGContext *s, int temp)
{
TCGTemp *ts;
ts = &s->temps[temp];
- s->current_frame_offset = (s->current_frame_offset + sizeof(tcg_target_long) - 1) & ~(sizeof(tcg_target_long) - 1);
- if (s->current_frame_offset + sizeof(tcg_target_long) > s->frame_end)
+ s->current_frame_offset = (s->current_frame_offset +
+ (tcg_target_long)sizeof(tcg_target_long) - 1) &
+ ~(sizeof(tcg_target_long) - 1);
+ if (s->current_frame_offset + (tcg_target_long)sizeof(tcg_target_long) >
+ s->frame_end) {
tcg_abort();
+ }
ts->mem_offset = s->current_frame_offset;
ts->mem_reg = s->frame_reg;
ts->mem_allocated = 1;
- s->current_frame_offset += sizeof(tcg_target_long);
+ s->current_frame_offset += (tcg_target_long)sizeof(tcg_target_long);
}
/* free register 'reg' by spilling the corresponding temporary if necessary */
--
1.7.2.5
next reply other threads:[~2011-05-14 19:38 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-05-14 19:38 Blue Swirl [this message]
2011-05-17 14:55 ` [Qemu-devel] [PATCH 05/11] TCG: fix negative frame offset calculations Richard Henderson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=BANLkTimtarbmim0dnOr3YwgjRSLr6bRmyw@mail.gmail.com \
--to=blauwirbel@gmail.com \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).