dfaggioli/qemu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

hw/timer/exynos4210_mct: fix possible int overflow

Browse Source 
The product "icnto * s->tcntb" may overflow uint32_t.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Dmitry Frolov <frolov@swemel.ru>
Message-id: 20241106083801.219578-2-frolov@swemel.ru
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Dmitry Frolov
2024-11-19 13:02:05 +00:00
committed by Peter Maydell
parent af4c4fd128
commit c5d36da7ec
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
hw/timer/exynos4210_mct.c
View File

@@ -815,7 +815,7 @@ static uint32_t exynos4210_ltick_cnt_get_cnto(struct tick_timer *s)
/* Both are counting */ /* Both are counting */
icnto = remain / s->tcntb; icnto = remain / s->tcntb;
if (icnto) { if (icnto) {
tcnto = remain % (icnto * s->tcntb); tcnto = remain % ((uint64_t)icnto * s->tcntb);
} else { } else {
tcnto = remain % s->tcntb; tcnto = remain % s->tcntb;
} }