diff options
| author | Paolo Bonzini | 2015-11-27 13:08:25 +0100 |
|---|---|---|
| committer | Michael Tokarev | 2015-12-04 07:39:55 +0100 |
| commit | e0df8f18f755d8c976db9bca2faabb763ad98ff2 (patch) | |
| tree | 0dd3afd06fdb2f9fae3cad65599fb3142ee30f2c /hw | |
| parent | util/id: fully allocate names table (diff) | |
| download | qemu-e0df8f18f755d8c976db9bca2faabb763ad98ff2.tar.gz qemu-e0df8f18f755d8c976db9bca2faabb763ad98ff2.tar.xz qemu-e0df8f18f755d8c976db9bca2faabb763ad98ff2.zip | |
bt: avoid unintended sign extension
In the case of a 4-byte length, shifting a value by 24 may cause
an unintended sign extension when converting from int to size_t.
Use a uint32_t variable instead.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/bt/sdp.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/hw/bt/sdp.c b/hw/bt/sdp.c index b9bcdcc78d..04eaecae67 100644 --- a/hw/bt/sdp.c +++ b/hw/bt/sdp.c @@ -42,7 +42,7 @@ struct bt_l2cap_sdp_state_s { static ssize_t sdp_datalen(const uint8_t **element, ssize_t *left) { - size_t len = *(*element) ++ & SDP_DSIZE_MASK; + uint32_t len = *(*element) ++ & SDP_DSIZE_MASK; if (!*left) return -1; |