mirror of https://gitlab.com/qemu-project/qemu
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
6c51df580d
In gen_mcrfs() the FPSCR nibble mask is computed as:
`~((0xF << shift) & FP_EX_CLEAR_BITS)`
Here, 0xF is of type int, so the left shift is performed in
32-bit signed arithmetic. For bfa=0 we get shift=28,
and (0xF << 28) = 0xF0000000, which is not representable as a 32-bit
signed int. Static analyzers flag this as a potential integer
overflow.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Denis Sergeev <zeff@altlinux.org>
Reviewed-by: Chinmay Rath <rathc@linux.ibm.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250915080118.29898-1-zeff@altlinux.org
Message-ID: <20250915080118.29898-1-zeff@altlinux.org>
|
2 weeks ago | |
|---|---|---|
| .. | ||
| bhrb-impl.c.inc | 1 year ago | |
| branch-impl.c.inc | 1 year ago | |
| dfp-impl.c.inc | 2 years ago | |
| fixedpoint-impl.c.inc | 1 year ago | |
| fp-impl.c.inc | 2 weeks ago | |
| fp-ops.c.inc | 2 weeks ago | |
| misc-impl.c.inc | 1 year ago | |
| ppe-impl.c.inc | 2 weeks ago | |
| processor-ctrl-impl.c.inc | 1 year ago | |
| spe-impl.c.inc | 2 years ago | |
| spe-ops.c.inc | 5 years ago | |
| storage-ctrl-impl.c.inc | 1 year ago | |
| vmx-impl.c.inc | 7 months ago | |
| vmx-ops.c.inc | 1 year ago | |
| vsx-impl.c.inc | 7 months ago | |
| vsx-ops.c.inc | 1 year ago | |