diff options
| author | Tigran Sogomonian <tsogomonian@astralinux.ru> | 2025-01-13 12:35:32 +0000 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2025-01-13 12:35:32 +0000 |
| commit | 593b910ebedb9f8969aba22ca35970f710722ba7 (patch) | |
| tree | 588ece8fe44b829cdb20ffeb7461734e373db1b4 | |
| parent | 906853e1427a1ff89c64c0ebb6faa9c68f0a5d74 (diff) | |
| download | qemu-593b910ebedb9f8969aba22ca35970f710722ba7.zip qemu-593b910ebedb9f8969aba22ca35970f710722ba7.tar.gz qemu-593b910ebedb9f8969aba22ca35970f710722ba7.tar.bz2 | |
hw/misc: cast rpm to uint64_t
The value of an arithmetic expression
'rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION' is a subject
to overflow because its operands are not cast to
a larger data type before performing arithmetic. Thus, need
to cast rpm to uint64_t.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Tigran Sogomonian <tsogomonian@astralinux.ru>
Reviewed-by: Patrick Leis <venture@google.com>
Reviewed-by: Hao Wu <wuhaotsh@google.com>
Message-id: 20241226130311.1349-1-tsogomonian@astralinux.ru
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| -rw-r--r-- | hw/misc/npcm7xx_mft.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/hw/misc/npcm7xx_mft.c b/hw/misc/npcm7xx_mft.c index 9fcc69f..e565cac 100644 --- a/hw/misc/npcm7xx_mft.c +++ b/hw/misc/npcm7xx_mft.c @@ -172,8 +172,9 @@ static NPCM7xxMFTCaptureState npcm7xx_mft_compute_cnt( * RPM = revolution/min. The time for one revlution (in ns) is * MINUTE_TO_NANOSECOND / RPM. */ - count = clock_ns_to_ticks(clock, (60 * NANOSECONDS_PER_SECOND) / - (rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION)); + count = clock_ns_to_ticks(clock, + (uint64_t)(60 * NANOSECONDS_PER_SECOND) / + ((uint64_t)rpm * NPCM7XX_MFT_PULSE_PER_REVOLUTION)); } if (count > NPCM7XX_MFT_MAX_CNT) { |