ramfb: fix overflow

> CID 1393621:    (OVERFLOW_BEFORE_WIDEN)
> Potentially overflowing expression "stride * s->height" with type "unsigned
> int" (32 bits, unsigned) is evaluated using +32-bit arithmetic, and then used
> in a context that expects an expression of type "hwaddr" (64 bits, unsigned).

Fix by changing stride from uint32_t to hwaddr.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20180626083120.19515-1-kraxel@redhat.com

diff --git a/hw/display/ramfb.c b/hw/display/ramfb.c
index 6867bce8aefbf294d44e333651d1a1f0b38e8b89..30f5c8da2056538c2cc1aad807c8d8734d359bc9 100644 (file)
--- a/hw/display/ramfb.c
+++ b/hw/display/ramfb.c
@@ -36,8 +36,8 @@ static void ramfb_fw_cfg_write(void *dev, off_t offset, size_t len)
 {
     RAMFBState *s = dev;
     void *framebuffer;
-    uint32_t stride, fourcc, format;
-    hwaddr addr, length;
+    uint32_t fourcc, format;
+    hwaddr stride, addr, length;
 
     s->width  = be32_to_cpu(s->cfg.width);
     s->height = be32_to_cpu(s->cfg.height);