motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-08 18:23:57 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

hw/display: check frame buffer can hold blob

Browse source 
Coverity reports (CID 1564769, 1564770) that we potentially overflow
by doing some 32x32 multiplies for something that ends up in a 64 bit
value. Fix this by first using stride for all lines and casting input
to uint64_t to ensure a 64 bit multiply is used.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Cc: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Tested-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Message-ID: <20241111230040.68470-3-alex.bennee@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
This commit is contained in:
Alex Bennée 2024-11-11 23:00:40 +00:00 • committed by Philippe Mathieu-Daudé
parent c4e1c361b3
commit 7b55742254
2 changed files with 2 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

3
hw/display/virtio-gpu.c
View file

@ -742,8 +742,7 @@ bool virtio_gpu_scanout_blob_to_fb(struct virtio_gpu_framebuffer *fb,
fb->offset = ss->offsets[0] + ss->r.x * fb->bytes_pp + ss->r.y * fb->stride;
fbend = fb->offset;
fbend += fb->stride * (ss->r.height - 1);
fbend += fb->bytes_pp * ss->r.width;
fbend += (uint64_t) fb->stride * ss->r.height;
if (fbend > blob_size) {
qemu_log_mask(LOG_GUEST_ERROR,