Source-Changes-HG archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

[src/trunk]: src/sys/dev Avoid possibility of integer overflow (and clean up).



details:   https://anonhg.NetBSD.org/src/rev/24ff3831b643
branches:  trunk
changeset: 826095:24ff3831b643
user:      isaki <isaki%NetBSD.org@localhost>
date:      Tue Aug 15 08:28:21 2017 +0000

description:
Avoid possibility of integer overflow (and clean up).
- On 32bit arch and type argument is int32_t, orig[m] * tomix[m] is
  calculated first with int32 (possibility of overflow here) and then
  cast to int64_t for assignment.
- bigger_type is sufficient for product and result.

diffstat:

 sys/dev/audio.c |  12 ++++++------
 1 files changed, 6 insertions(+), 6 deletions(-)

diffs (40 lines):

diff -r 8f9dad0991a1 -r 24ff3831b643 sys/dev/audio.c
--- a/sys/dev/audio.c   Tue Aug 15 06:57:53 2017 +0000
+++ b/sys/dev/audio.c   Tue Aug 15 08:28:21 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: audio.c,v 1.397 2017/08/15 05:31:52 isaki Exp $        */
+/*     $NetBSD: audio.c,v 1.398 2017/08/15 08:28:21 isaki Exp $        */
 
 /*-
  * Copyright (c) 2016 Nathanial Sloss <nathanialsloss%yahoo.com.au@localhost>
@@ -148,7 +148,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: audio.c,v 1.397 2017/08/15 05:31:52 isaki Exp $");
+__KERNEL_RCSID(0, "$NetBSD: audio.c,v 1.398 2017/08/15 08:28:21 isaki Exp $");
 
 #ifdef _KERNEL_OPT
 #include "audio.h"
@@ -5515,8 +5515,8 @@
                  struct virtual_channel *vc)                           \
        {                                                               \
                int blksize, cc, cc1, cc2, m, resid;                    \
-               int64_t product;                                        \
-               int64_t result;                                         \
+               bigger_type product;                                    \
+               bigger_type result;                                     \
                type *orig, *tomix;                                     \
                                                                        \
                blksize = sc->sc_pr.blksize;                            \
@@ -5537,8 +5537,8 @@
                        for (m = 0; m < (cc / (bits / NBBY)); m++) {    \
                                tomix[m] = (bigger_type)tomix[m] *      \
                                    (bigger_type)(vc->sc_swvol) / 255;  \
-                               result = orig[m] + tomix[m];            \
-                               product = orig[m] * tomix[m];           \
+                               result = (bigger_type)orig[m] + tomix[m]; \
+                               product = (bigger_type)orig[m] * tomix[m]; \
                                if (orig[m] > 0 && tomix[m] > 0)        \
                                        result -= product / MAXVAL;     \
                                else if (orig[m] < 0 && tomix[m] < 0)   \



Home | Main Index | Thread Index | Old Index