| Message ID | 20200516190211.4120-1-andrew.cooper3@citrix.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | x86/hvm: Fix shifting in stdvga_mem_read() | expand |
On 16.05.2020 21:02, Andrew Cooper wrote: > stdvga_mem_read() has a return type of uint8_t, which promotes to int rather > than unsigned int. Shifting by 24 may hit the sign bit. > > Spotted by Coverity. > > Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com>
diff --git a/xen/arch/x86/hvm/stdvga.c b/xen/arch/x86/hvm/stdvga.c index bd398dbb1b..e2675139e7 100644 --- a/xen/arch/x86/hvm/stdvga.c +++ b/xen/arch/x86/hvm/stdvga.c @@ -322,7 +322,7 @@ static int stdvga_mem_read(const struct hvm_io_handler *handler, data = stdvga_mem_readb(addr); data |= stdvga_mem_readb(addr + 1) << 8; data |= stdvga_mem_readb(addr + 2) << 16; - data |= stdvga_mem_readb(addr + 3) << 24; + data |= (uint32_t)stdvga_mem_readb(addr + 3) << 24; break; case 8:
stdvga_mem_read() has a return type of uint8_t, which promotes to int rather than unsigned int. Shifting by 24 may hit the sign bit. Spotted by Coverity. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> --- CC: Jan Beulich <JBeulich@suse.com> CC: Wei Liu <wl@xen.org> CC: Roger Pau Monné <roger.pau@citrix.com> --- xen/arch/x86/hvm/stdvga.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)