diff mbox series

[PULL,19/28] hw/ide/atapi: Be explicit that assigning to s->lcyl truncates

Message ID 20240806125157.91185-20-philmd@linaro.org
State Accepted
Commit f63085c85d164484a58fa320114f389c91194487
Headers show
Series [PULL,01/28] hw/intc/loongson_ipi: Rename LoongsonIPI -> LoongsonIPIState | expand

Commit Message

Philippe Mathieu-Daudé Aug. 6, 2024, 12:51 p.m. UTC 
From: Peter Maydell <peter.maydell@linaro.org>

In ide_atapi_cmd_reply_end() we calculate a 16-bit size, and then
assign its two halves to s->lcyl and s->hcyl like this:

           s->lcyl = size;
           s->hcyl = size >> 8;

Coverity warns that the first line here can overflow the
8-bit s->lcyl variable. This is true, and in this case we're
deliberately only after the low 8 bits of the value. The
code is clearer to both humans and Coverity if we're explicit
that we only wanted the low 8 bits, though.

Resolves: Coverity CID 1547621
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20240731143617.3391947-5-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/ide/atapi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/hw/ide/atapi.c b/hw/ide/atapi.c
index fcb6cca157..e82959dc2d 100644
--- a/hw/ide/atapi.c
+++ b/hw/ide/atapi.c
@@ -265,7 +265,7 @@  void ide_atapi_cmd_reply_end(IDEState *s)
                     byte_count_limit--;
                 size = byte_count_limit;
             }
-            s->lcyl = size;
+            s->lcyl = size & 0xff;
             s->hcyl = size >> 8;
             s->elementary_transfer_size = size;
             /* we cannot transmit more than one sector at a time */