On Mon, 9 Mar 2026, Philippe Mathieu-Daudé wrote:
On 9/3/26 22:41, BALATON Zoltan wrote:
On Mon, 9 Mar 2026, Chad Jablonski wrote:
Cast default_sc_bottom to uint32_t before shifting left to prevent
sign extension when assigning to uint64_t.
Fixes: CID 1645615
Signed-off-by: Chad Jablonski <[email protected]>
---
hw/display/ati.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/display/ati.c b/hw/display/ati.c
index 6cf243bcf9..f9773e1154 100644
--- a/hw/display/ati.c
+++ b/hw/display/ati.c
@@ -514,7 +514,7 @@ static uint64_t ati_mm_read(void *opaque, hwaddr addr,
unsigned int size)
val |= s->regs.default_tile << 16;
break;
case DEFAULT_SC_BOTTOM_RIGHT:
- val = (s->regs.default_sc_bottom << 16) |
+ val = ((uint32_t)s->regs.default_sc_bottom << 16) |
s->regs.default_sc_right;
What about using deposit64() which is uncontroversial?
val = deposit64(s->regs.default_sc_right, 16,
13, s->regs.default_sc_bottom);
I can't make sense of that without going and looking what the arguments of
this function are so I'd rather keep it simple. As I said, the values here
can't be large enough to sign extend and there may be other similar cases
that are already marked in Coverity. But if we still want to fix all of
them then maybe we could try to make val uint32_t then do something about
it once at the return for all cases. That seems better than trying to
handle in each case inconsistently. The simplest would still be to tell
Converity it's wrong here.
Regards,
BALATON Zoltan
