d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

aic7xxx(4): Fix unintended sign extension in ahd_inq()

Browse Source 
ahd_inb() returns type uint8_t.  The shift left by untyped 24 implicitly
promotes the result to type (signed) int.  Then the binary OR with uint64_t
values sign-extends the integer.  If bit 31 of the read value happened to be
set, the 64-bit result would have all upper 32 bits set to 1 due to OR.  This
is clearly not intended.

Reported by:	Coverity
CID:		980473 (old one!)
This commit is contained in:
Conrad Meyer 2020-01-30 18:12:24 +00:00
parent e3907d2395
commit 295e4149b0
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/dev/aic7xxx/aic79xx_inline.h
View File

@ -567,7 +567,7 @@ ahd_inq(struct ahd_softc *ahd, u_int port)
return ((ahd_inb(ahd, port))
| (ahd_inb(ahd, port+1) << 8)
| (ahd_inb(ahd, port+2) << 16)
| (ahd_inb(ahd, port+3) << 24)
| (((uint64_t)ahd_inb(ahd, port+3)) << 24)
| (((uint64_t)ahd_inb(ahd, port+4)) << 32)
| (((uint64_t)ahd_inb(ahd, port+5)) << 40)
| (((uint64_t)ahd_inb(ahd, port+6)) << 48)