Re: [PATCH] target/ppc: avoid int32 multiply overflow in int_helper.c

[Daniel Henrique Barboza]

Queued in gitlab.com/danielhb/qemu/tree/ppc-next. Thanks,


Daniel

On 6/2/22 11:14, Daniel Henrique Barboza wrote:
> Coverity is not thrilled about the multiply operations being done in
> ger_rank8() and ger_rank2(), giving an error like the following:
>
> Integer handling issues  (OVERFLOW_BEFORE_WIDEN)
>      Potentially overflowing expression "sextract32(a, 4 * i, 4) *
> sextract32(b, 4 * i, 4)" with type "int" (32 bits, signed) is evaluated
> using 32-bit arithmetic, and then used in a context that expects an
> expression of type "int64_t" (64 bits, signed).
>
> Fix both instances where this occur by adding an int64_t cast in the
> first operand, forcing the result to be 64 bit.
>
> Fixes: Coverity CID 1489444, 1489443
> Fixes: 345531533f26 ("target/ppc: Implemented xvi*ger* instructions")
> Cc: Lucas Mateus Castro (alqotel) <lucas.araujo@eldorado.org.br>
> Cc: Richard Henderson <richard.henderson@linaro.org>
> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
> ---
>   target/ppc/int_helper.c | 5 +++--
>   1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/target/ppc/int_helper.c b/target/ppc/int_helper.c
> index 105b626d1b..eb65ab4d82 100644
> --- a/target/ppc/int_helper.c
> +++ b/target/ppc/int_helper.c
> @@ -789,7 +789,7 @@ static int64_t ger_rank8(uint32_t a, uint32_t b, uint32_t 
> mask)
>       int64_t psum = 0;
>       for (int i = 0; i < 8; i++, mask >>= 1) {
>           if (mask & 1) {
> -            psum += sextract32(a, 4 * i, 4) * sextract32(b, 4 * i, 4);
> +            psum += (int64_t)sextract32(a, 4 * i, 4) * sextract32(b, 4 * i, 4);
>           }
>       }
>       return psum;
> @@ -811,7 +811,8 @@ static int64_t ger_rank2(uint32_t a, uint32_t b, uint32_t 
> mask)
>       int64_t psum = 0;
>       for (int i = 0; i < 2; i++, mask >>= 1) {
>           if (mask & 1) {
> -            psum += sextract32(a, 16 * i, 16) * sextract32(b, 16 * i, 16);
> +            psum += (int64_t)sextract32(a, 16 * i, 16) *
> +                             sextract32(b, 16 * i, 16);
>           }
>       }
>       return psum;