[Qemu-devel] [PATCH 05/11] TCG: fix negative frame offset calculations

[Blue Swirl]

size_t is unsigned, so the frame offset calculations can be incorrect for
negative offsets.

Signed-off-by: Blue Swirl <blauwir...@gmail.com>
---
 tcg/tcg.c |   10 +++++++---
 1 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/tcg/tcg.c b/tcg/tcg.c
index 8748c05..75972c3 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1434,13 +1434,17 @@ static void temp_allocate_frame(TCGContext *s, int temp)
 {
     TCGTemp *ts;
     ts = &s->temps[temp];
-    s->current_frame_offset = (s->current_frame_offset +
sizeof(tcg_target_long) - 1) & ~(sizeof(tcg_target_long) - 1);
-    if (s->current_frame_offset + sizeof(tcg_target_long) > s->frame_end)
+    s->current_frame_offset = (s->current_frame_offset +
+                               (tcg_target_long)sizeof(tcg_target_long) - 1) &
+        ~(sizeof(tcg_target_long) - 1);
+    if (s->current_frame_offset + (tcg_target_long)sizeof(tcg_target_long) >
+        s->frame_end) {
         tcg_abort();
+    }
     ts->mem_offset = s->current_frame_offset;
     ts->mem_reg = s->frame_reg;
     ts->mem_allocated = 1;
-    s->current_frame_offset += sizeof(tcg_target_long);
+    s->current_frame_offset += (tcg_target_long)sizeof(tcg_target_long);
 }

 /* free register 'reg' by spilling the corresponding temporary if necessary */
-- 
1.6.2.4

From 13a409bacd4862293c4d65e8bef662779e5a0e47 Mon Sep 17 00:00:00 2001
Message-Id: <13a409bacd4862293c4d65e8bef662779e5a0e47.1305401750.git.blauwir...@gmail.com>
In-Reply-To: <6e21df8e369388a3152dcc7da30431c672e1ee37.1305401750.git.blauwir...@gmail.com>
References: <6e21df8e369388a3152dcc7da30431c672e1ee37.1305401750.git.blauwir...@gmail.com>
From: Blue Swirl <blauwir...@gmail.com>
Date: Sat, 14 May 2011 14:03:22 +0000
Subject: [PATCH 05/11] TCG: fix negative frame offset calculations

size_t is unsigned, so the frame offset calculations can be incorrect for
negative offsets.

Signed-off-by: Blue Swirl <blauwir...@gmail.com>
---
 tcg/tcg.c |   10 +++++++---
 1 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/tcg/tcg.c b/tcg/tcg.c
index 8748c05..75972c3 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1434,13 +1434,17 @@ static void temp_allocate_frame(TCGContext *s, int temp)
 {
     TCGTemp *ts;
     ts = &s->temps[temp];
-    s->current_frame_offset = (s->current_frame_offset + sizeof(tcg_target_long) - 1) & ~(sizeof(tcg_target_long) - 1);
-    if (s->current_frame_offset + sizeof(tcg_target_long) > s->frame_end)
+    s->current_frame_offset = (s->current_frame_offset +
+                               (tcg_target_long)sizeof(tcg_target_long) - 1) &
+        ~(sizeof(tcg_target_long) - 1);
+    if (s->current_frame_offset + (tcg_target_long)sizeof(tcg_target_long) >
+        s->frame_end) {
         tcg_abort();
+    }
     ts->mem_offset = s->current_frame_offset;
     ts->mem_reg = s->frame_reg;
     ts->mem_allocated = 1;
-    s->current_frame_offset += sizeof(tcg_target_long);
+    s->current_frame_offset += (tcg_target_long)sizeof(tcg_target_long);
 }
 
 /* free register 'reg' by spilling the corresponding temporary if necessary */
-- 
1.7.2.5