diff options
author | Paolo Bonzini <pbonzini@redhat.com> | 2015-11-27 13:08:25 +0100 |
---|---|---|
committer | Michael Tokarev <mjt@tls.msk.ru> | 2015-12-04 09:39:55 +0300 |
commit | e0df8f18f755d8c976db9bca2faabb763ad98ff2 (patch) | |
tree | 0dd3afd06fdb2f9fae3cad65599fb3142ee30f2c /hw | |
parent | 624533e5a53e5df347e46f06408d15b9df5254f0 (diff) | |
download | qemu-e0df8f18f755d8c976db9bca2faabb763ad98ff2.zip qemu-e0df8f18f755d8c976db9bca2faabb763ad98ff2.tar.gz qemu-e0df8f18f755d8c976db9bca2faabb763ad98ff2.tar.bz2 |
bt: avoid unintended sign extension
In the case of a 4-byte length, shifting a value by 24 may cause
an unintended sign extension when converting from int to size_t.
Use a uint32_t variable instead.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Diffstat (limited to 'hw')
-rw-r--r-- | hw/bt/sdp.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/hw/bt/sdp.c b/hw/bt/sdp.c index b9bcdcc..04eaeca 100644 --- a/hw/bt/sdp.c +++ b/hw/bt/sdp.c @@ -42,7 +42,7 @@ struct bt_l2cap_sdp_state_s { static ssize_t sdp_datalen(const uint8_t **element, ssize_t *left) { - size_t len = *(*element) ++ & SDP_DSIZE_MASK; + uint32_t len = *(*element) ++ & SDP_DSIZE_MASK; if (!*left) return -1; |