From fc2527fb024abf92719952c939d751739455bd6b Mon Sep 17 00:00:00 2001 From: Cédric Le Goater Date: Tue, 7 Jan 2020 18:18:09 +0100 Subject: ppc/pnv: fix check on return value of blk_getlength() blk_getlength() returns an int64_t but the result is stored in a uint32_t. Errors (negative values) won't be caught by the check in pnv_pnor_realize() and blk_blockalign() will allocate a very large buffer in such cases. Fixes Coverity issue CID 1412226. Signed-off-by: Cédric Le Goater Message-Id: <20200107171809.15556-3-clg@kaod.org> Reviewed-by: Greg Kurz Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: David Gibson --- include/hw/ppc/pnv_pnor.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/hw/ppc/pnv_pnor.h b/include/hw/ppc/pnv_pnor.h index c3dd28643c..4f96abdfb4 100644 --- a/include/hw/ppc/pnv_pnor.h +++ b/include/hw/ppc/pnv_pnor.h @@ -23,7 +23,7 @@ typedef struct PnvPnor { BlockBackend *blk; uint8_t *storage; - uint32_t size; + int64_t size; MemoryRegion mmio; } PnvPnor; -- cgit v1.2.3-55-g7522