[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL for-2.3 1/4] nvme: Fix unintentional integer overflow
|
From: |
Stefan Hajnoczi |
|
Subject: |
[Qemu-devel] [PULL for-2.3 1/4] nvme: Fix unintentional integer overflow (OVERFLOW_BEFORE_WIDEN) |
|
Date: |
Fri, 27 Mar 2015 10:20:45 +0000 |
From: Stefan Weil <address@hidden>
The shift operation on nlb gives a 32 bit result if no type cast is
applied. This bug was reported by Coverity.
Signed-off-by: Stefan Weil <address@hidden>
Message-id: address@hidden
Signed-off-by: Stefan Hajnoczi <address@hidden>
---
hw/block/nvme.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/block/nvme.c b/hw/block/nvme.c
index 0f3dfb9..1e07166 100644
--- a/hw/block/nvme.c
+++ b/hw/block/nvme.c
@@ -222,7 +222,7 @@ static uint16_t nvme_rw(NvmeCtrl *n, NvmeNamespace *ns,
NvmeCmd *cmd,
uint8_t lba_index = NVME_ID_NS_FLBAS_INDEX(ns->id_ns.flbas);
uint8_t data_shift = ns->id_ns.lbaf[lba_index].ds;
- uint64_t data_size = nlb << data_shift;
+ uint64_t data_size = (uint64_t)nlb << data_shift;
uint64_t aio_slba = slba << (data_shift - BDRV_SECTOR_BITS);
int is_write = rw->opcode == NVME_CMD_WRITE ? 1 : 0;
--
2.1.0