sravan/system76-coreboot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

libpayload: cbgfx: Fix potential overflowing expression

Browse Source 
BRANCH=none
BUG=none
TEST=none

Change-Id: Icd37a6abc01d9fcbcf54525d47b15c9930a9b9fb
Signed-off-by: Yu-Ping Wu <yupingso@google.com>
Found-by: Coverity Scan #1419491
Reviewed-on: https://review.coreboot.org/c/coreboot/+/38987
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Patrick Georgi <pgeorgi@google.com>
This commit is contained in:
Yu-Ping Wu 2020-02-19 11:55:34 +08:00 committed by Patrick Georgi
parent 8d1b0f1dbd
commit 255aeaa9a2
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
payloads/libpayload/drivers/video/graphics.c
View File

@ -349,8 +349,8 @@ int draw_rounded_box(const struct scale *pos_rel, const struct scale *dim_rel,
/* Use 64 bits to avoid overflow */ /* Use 64 bits to avoid overflow */
int32_t x, y; int32_t x, y;
uint64_t yy; uint64_t yy;
const uint64_t rrx = r.x * r.x, rry = r.y * r.y; const uint64_t rrx = (uint64_t)r.x * r.x, rry = (uint64_t)r.y * r.y;
const uint64_t ssx = s.x * s.x, ssy = s.y * s.y; const uint64_t ssx = (uint64_t)s.x * s.x, ssy = (uint64_t)s.y * s.y;
x_begin = 0; x_begin = 0;
x_end = 0; x_end = 0;
for (y = r.y - 1; y >= 0; y--) { for (y = r.y - 1; y >= 0; y--) {
@ -358,7 +358,7 @@ int draw_rounded_box(const struct scale *pos_rel, const struct scale *dim_rel,
* The inequality is valid in the beginning of each iteration: * The inequality is valid in the beginning of each iteration:
* y^2 + x_end^2 < r^2 * y^2 + x_end^2 < r^2
*/ */
yy = y * y; yy = (uint64_t)y * y;
/* Check yy/ssy + xx/ssx < 1 */ /* Check yy/ssy + xx/ssx < 1 */
while (yy * ssx + x_begin * x_begin * ssy < ssx * ssy) while (yy * ssx + x_begin * x_begin * ssy < ssx * ssy)
x_begin++; x_begin++;