motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-10 02:54:58 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

hw/timer/exynos4210_mct: fix possible int overflow

Browse source 
The product "icnto * s->tcntb" may overflow uint32_t.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Dmitry Frolov <frolov@swemel.ru>
Message-id: 20241106083801.219578-2-frolov@swemel.ru
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Dmitry Frolov 2024-11-19 13:02:05 +00:00 • committed by Peter Maydell
parent af4c4fd128
commit c5d36da7ec
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
hw/timer/exynos4210_mct.c
View file

@ -815,7 +815,7 @@ static uint32_t exynos4210_ltick_cnt_get_cnto(struct tick_timer *s)
/* Both are counting */ /* Both are counting */
icnto = remain / s->tcntb; icnto = remain / s->tcntb;
if (icnto) { if (icnto) {
tcnto = remain % (icnto * s->tcntb); tcnto = remain % ((uint64_t)icnto * s->tcntb);
} else { } else {
tcnto = remain % s->tcntb; tcnto = remain % s->tcntb;
} }