| commit | fc2527fb024abf92719952c939d751739455bd6b | |
| author | Cédric Le Goater <clg@kaod.org> | |
| Tue, 7 Jan 2020 17:18:09 +0000 (7 18:18 +0100) | ||
| committer | David Gibson <david@gibson.dropbear.id.au> | |
| Wed, 8 Jan 2020 01:01:14 +0000 (8 12:01 +1100) | ||
| tree | 4a4928027ce57451c22d8421df6eee2f9aa97337 | treesnapshot (tar.gz zip) |
| parent | 3a688294e2c36575fd3e259a64a066b38e164cbb | commitdiff |
ppc/pnv: fix check on return value of blk_getlength()
blk_getlength() returns an int64_t but the result is stored in a
uint32_t. Errors (negative values) won't be caught by the check in
pnv_pnor_realize() and blk_blockalign() will allocate a very large
buffer in such cases.
Fixes Coverity issue CID 1412226.
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20200107171809.15556-3-clg@kaod.org>
Reviewed-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
blk_getlength() returns an int64_t but the result is stored in a
uint32_t. Errors (negative values) won't be caught by the check in
pnv_pnor_realize() and blk_blockalign() will allocate a very large
buffer in such cases.
Fixes Coverity issue CID 1412226.
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20200107171809.15556-3-clg@kaod.org>
Reviewed-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
| hw/ppc/pnv_pnor.c | diffblobblamehistory | |
| include/hw/ppc/pnv_pnor.h | diffblobblamehistory |