From mboxrd@z Thu Jan 1 00:00:00 1970 From: Konrad Rzeszutek Wilk Subject: [PATCH 4/4] tmem: fix Out-of-bounds read reported by Coverity Date: Wed, 30 Apr 2014 16:29:16 -0400 Message-ID: <1398889756-16352-5-git-send-email-konrad.wilk@oracle.com> References: <1398889756-16352-1-git-send-email-konrad.wilk@oracle.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mail6.bemta4.messagelabs.com ([85.158.143.247]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1Wfb8A-0001dt-GD for xen-devel@lists.xenproject.org; Wed, 30 Apr 2014 20:29:26 +0000 In-Reply-To: <1398889756-16352-1-git-send-email-konrad.wilk@oracle.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: xen-devel@lists.xenproject.org, andrew.cooper3@citrix.com, jbeulich@suse.com, keir@xen.org Cc: Konrad Rzeszutek Wilk List-Id: xen-devel@lists.xenproject.org From: Bob Liu CID 1198729, CID 1198730 and CID 1198734 complain about "Out-of-bounds read". This patch fixes them by casting the 'firstbyte' to (uint8_t). Signed-off-by: Bob Liu Signed-off-by: Konrad Rzeszutek Wilk --- xen/common/tmem.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/xen/common/tmem.c b/xen/common/tmem.c index f2dc26e..506c6be 100644 --- a/xen/common/tmem.c +++ b/xen/common/tmem.c @@ -399,7 +399,7 @@ static void pcd_disassociate(struct tmem_page_descriptor *pgp, struct tmem_pool { struct tmem_page_content_descriptor *pcd = pgp->pcd; struct page_info *pfp = pgp->pcd->pfp; - uint16_t firstbyte = pgp->firstbyte; + uint8_t firstbyte = pgp->firstbyte; char *pcd_tze = pgp->pcd->tze; pagesize_t pcd_size = pcd->size; pagesize_t pgp_size = pgp->size; @@ -1231,7 +1231,7 @@ static bool_t tmem_try_to_evict_pgp(struct tmem_page_descriptor *pgp, bool_t *ho struct tmem_object_root *obj = pgp->us.obj; struct tmem_pool *pool = obj->pool; struct client *client = pool->client; - uint16_t firstbyte = pgp->firstbyte; + uint8_t firstbyte = pgp->firstbyte; if ( pool->is_dying ) return 0; -- 1.8.5.3