Coverity warns in CID 1645968 about possible integer overflow. This
should never happen but to ensure that, add an upper limit on the
x-linear-aper-size. This may not silence the warning but makes sure
users cannot cause an overflow.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
---
 hw/display/ati.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/display/ati.c b/hw/display/ati.c
index fc19737d1f..97d871b1e2 100644
--- a/hw/display/ati.c
+++ b/hw/display/ati.c
@@ -1130,6 +1130,10 @@ static void ati_vga_realize(PCIDevice *dev, Error **errp)
             s->linear_aper_sz = ATI_R100_LINEAR_APER_SIZE;
         }
     }
+    if (s->linear_aper_sz > 256 * MiB) {
+        error_setg(errp, "x-linear-aper-size is too large (maximum 256 MiB)");
+        return;
+    }
     if (s->linear_aper_sz < 16 * MiB) {
         error_setg(errp, "x-linear-aper-size is too small (minimum 16 MiB)");
         return;
-- 
2.41.3

On 30/3/26 23:09, BALATON Zoltan wrote:
> Coverity warns in CID 1645968 about possible integer overflow. This
> should never happen but to ensure that, add an upper limit on the
> x-linear-aper-size. This may not silence the warning but makes sure
> users cannot cause an overflow.
> 
> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
> ---
>   hw/display/ati.c | 4 ++++
>   1 file changed, 4 insertions(+)

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

On Mon, 30 Mar 2026 at 22:09, BALATON Zoltan <balaton@eik.bme.hu> wrote:
>
> Coverity warns in CID 1645968 about possible integer overflow. This
> should never happen but to ensure that, add an upper limit on the
> x-linear-aper-size. This may not silence the warning but makes sure
> users cannot cause an overflow.
>
> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
> ---
>  hw/display/ati.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/hw/display/ati.c b/hw/display/ati.c
> index fc19737d1f..97d871b1e2 100644
> --- a/hw/display/ati.c
> +++ b/hw/display/ati.c
> @@ -1130,6 +1130,10 @@ static void ati_vga_realize(PCIDevice *dev, Error **errp)
>              s->linear_aper_sz = ATI_R100_LINEAR_APER_SIZE;
>          }
>      }
> +    if (s->linear_aper_sz > 256 * MiB) {
> +        error_setg(errp, "x-linear-aper-size is too large (maximum 256 MiB)");
> +        return;
> +    }
>      if (s->linear_aper_sz < 16 * MiB) {
>          error_setg(errp, "x-linear-aper-size is too small (minimum 16 MiB)");
>          return;
> --
> 2.41.3
>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

thanks
-- PMM