x86/hvm: Fix shifting in stdvga_mem_read()

[PATCH] x86/hvm: Fix shifting in stdvga_mem_read()

Andrew Cooper posted 1 patch 3 years, 11 months ago

Download mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/xen tags/patchew/20200516190211.4120-1-andrew.cooper3@citrix.com

xen/arch/x86/hvm/stdvga.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

Expand all Fold all

[PATCH] x86/hvm: Fix shifting in stdvga_mem_read()

Posted by Andrew Cooper 3 years, 11 months ago

stdvga_mem_read() has a return type of uint8_t, which promotes to int rather
than unsigned int.  Shifting by 24 may hit the sign bit.

Spotted by Coverity.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Jan Beulich <JBeulich@suse.com>
CC: Wei Liu <wl@xen.org>
CC: Roger Pau Monné <roger.pau@citrix.com>
---
 xen/arch/x86/hvm/stdvga.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xen/arch/x86/hvm/stdvga.c b/xen/arch/x86/hvm/stdvga.c
index bd398dbb1b..e2675139e7 100644
--- a/xen/arch/x86/hvm/stdvga.c
+++ b/xen/arch/x86/hvm/stdvga.c
@@ -322,7 +322,7 @@ static int stdvga_mem_read(const struct hvm_io_handler *handler,
         data = stdvga_mem_readb(addr);
         data |= stdvga_mem_readb(addr + 1) << 8;
         data |= stdvga_mem_readb(addr + 2) << 16;
-        data |= stdvga_mem_readb(addr + 3) << 24;
+        data |= (uint32_t)stdvga_mem_readb(addr + 3) << 24;
         break;
 
     case 8:
-- 
2.11.0

Re: [PATCH] x86/hvm: Fix shifting in stdvga_mem_read()

Posted by Jan Beulich 3 years, 11 months ago

On 16.05.2020 21:02, Andrew Cooper wrote:
> stdvga_mem_read() has a return type of uint8_t, which promotes to int rather
> than unsigned int.  Shifting by 24 may hit the sign bit.
> 
> Spotted by Coverity.
> 
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>

Reviewed-by: Jan Beulich <jbeulich@suse.com>