diff options
| author | Cédric Le Goater | 2020-01-07 18:18:09 +0100 |
|---|---|---|
| committer | David Gibson | 2020-01-08 02:01:14 +0100 |
| commit | fc2527fb024abf92719952c939d751739455bd6b (patch) | |
| tree | 4a4928027ce57451c22d8421df6eee2f9aa97337 /hw/ppc/pnv_pnor.c | |
| parent | ppc/pnv: check return value of blk_pwrite() (diff) | |
| download | qemu-fc2527fb024abf92719952c939d751739455bd6b.tar.gz qemu-fc2527fb024abf92719952c939d751739455bd6b.tar.xz qemu-fc2527fb024abf92719952c939d751739455bd6b.zip | |
ppc/pnv: fix check on return value of blk_getlength()
blk_getlength() returns an int64_t but the result is stored in a
uint32_t. Errors (negative values) won't be caught by the check in
pnv_pnor_realize() and blk_blockalign() will allocate a very large
buffer in such cases.
Fixes Coverity issue CID 1412226.
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20200107171809.15556-3-clg@kaod.org>
Reviewed-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Diffstat (limited to 'hw/ppc/pnv_pnor.c')
| -rw-r--r-- | hw/ppc/pnv_pnor.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/hw/ppc/pnv_pnor.c b/hw/ppc/pnv_pnor.c index 0e86ae2fea..b061106d1c 100644 --- a/hw/ppc/pnv_pnor.c +++ b/hw/ppc/pnv_pnor.c @@ -111,7 +111,7 @@ static void pnv_pnor_realize(DeviceState *dev, Error **errp) } static Property pnv_pnor_properties[] = { - DEFINE_PROP_UINT32("size", PnvPnor, size, 128 << 20), + DEFINE_PROP_INT64("size", PnvPnor, size, 128 << 20), DEFINE_PROP_DRIVE("drive", PnvPnor, blk), DEFINE_PROP_END_OF_LIST(), }; |