From e0df8f18f755d8c976db9bca2faabb763ad98ff2 Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Fri, 27 Nov 2015 13:08:25 +0100 Subject: bt: avoid unintended sign extension In the case of a 4-byte length, shifting a value by 24 may cause an unintended sign extension when converting from int to size_t. Use a uint32_t variable instead. Signed-off-by: Paolo Bonzini Reviewed-by: Markus Armbruster Signed-off-by: Michael Tokarev --- hw/bt/sdp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'hw') diff --git a/hw/bt/sdp.c b/hw/bt/sdp.c index b9bcdcc..04eaeca 100644 --- a/hw/bt/sdp.c +++ b/hw/bt/sdp.c @@ -42,7 +42,7 @@ struct bt_l2cap_sdp_state_s { static ssize_t sdp_datalen(const uint8_t **element, ssize_t *left) { - size_t len = *(*element) ++ & SDP_DSIZE_MASK; + uint32_t len = *(*element) ++ & SDP_DSIZE_MASK; if (!*left) return -1; -- cgit v1.1 From 63fc7375d6b0a083aef56950119af3d1d2a96e51 Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Fri, 6 Nov 2015 16:34:06 +0100 Subject: gt64xxx: fix decoding of ISD register The GT64xxx's internal registers can be placed above the first 4 GiB in the address space, but not above the first 64 GiB. Correctly cast the register to a 64-bit integer, and mask away bits above bit 35. Datasheet at http://pdf.datasheetarchive.com/datasheetsmain/Datasheets-33/DSA-655889.pdf (bug reported by Coverity). Signed-off-by: Paolo Bonzini Signed-off-by: Michael Tokarev --- hw/mips/gt64xxx_pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'hw') diff --git a/hw/mips/gt64xxx_pci.c b/hw/mips/gt64xxx_pci.c index 10fcca3..f76a9fd 100644 --- a/hw/mips/gt64xxx_pci.c +++ b/hw/mips/gt64xxx_pci.c @@ -275,7 +275,8 @@ static void check_reserved_space (hwaddr *start, static void gt64120_isd_mapping(GT64120State *s) { - hwaddr start = s->regs[GT_ISD] << 21; + /* Bits 14:0 of ISD map to bits 35:21 of the start address. */ + hwaddr start = ((hwaddr)s->regs[GT_ISD] << 21) & 0xFFFE00000ull; hwaddr length = 0x1000; if (s->ISD_length) { -- cgit v1.1