From d6902d7022ba1405a991c94a99b37259d0a6d3a7 Mon Sep 17 00:00:00 2001 From: Alex Bennée Date: Mon, 11 Nov 2024 23:00:40 +0000 Subject: hw/display: check frame buffer can hold blob MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Coverity reports (CID 1564769, 1564770) that we potentially overflow by doing some 32x32 multiplies for something that ends up in a 64 bit value. Fix this by first using stride for all lines and casting input to uint64_t to ensure a 64 bit multiply is used. Reviewed-by: Dmitry Osipenko Tested-by: Dmitry Osipenko Signed-off-by: Alex Bennée Message-Id: <20241111230040.68470-3-alex.bennee@linaro.org> --- hw/display/virtio-gpu.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'hw/display/virtio-gpu.c') diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c index e7ca8fd1cf..7d22d03bbf 100644 --- a/hw/display/virtio-gpu.c +++ b/hw/display/virtio-gpu.c @@ -742,8 +742,7 @@ bool virtio_gpu_scanout_blob_to_fb(struct virtio_gpu_framebuffer *fb, fb->offset = ss->offsets[0] + ss->r.x * fb->bytes_pp + ss->r.y * fb->stride; fbend = fb->offset; - fbend += fb->stride * (ss->r.height - 1); - fbend += fb->bytes_pp * ss->r.width; + fbend += (uint64_t) fb->stride * ss->r.height; if (fbend > blob_size) { qemu_log_mask(LOG_GUEST_ERROR, -- cgit 1.4.1