blankie
/
wlroots
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

drm backend: overflow fixes 

These operations are done in 32-bit arithmetics before being casted to 64-bit,
thus can overflow before the cast.
Casting early fixes the issue.

Found through static analysis
This commit is contained in:
Dominique Martinet 2018-06-30 09:59:44 +09:00
parent 63eb720871
commit f0d455f088
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
backend/drm/atomic.c
View File

@ -83,8 +83,8 @@ static void set_plane_props(struct atomic *atom, struct wlr_drm_plane *plane,
// The src_* properties are in 16.16 fixed point
atomic_add(atom, id, props->src_x, 0);
atomic_add(atom, id, props->src_y, 0);
atomic_add(atom, id, props->src_w, plane->surf.width << 16);
atomic_add(atom, id, props->src_h, plane->surf.height << 16);
atomic_add(atom, id, props->src_w, (uint64_t)plane->surf.width << 16);
atomic_add(atom, id, props->src_h, (uint64_t)plane->surf.height << 16);
atomic_add(atom, id, props->crtc_w, plane->surf.width);
atomic_add(atom, id, props->crtc_h, plane->surf.height);
atomic_add(atom, id, props->fb_id, fb_id);

2
backend/drm/drm.c
View File

@ -973,7 +973,7 @@ int handle_drm_event(int fd, uint32_t mask, void *data) {
}
void restore_drm_outputs(struct wlr_drm_backend *drm) {
uint64_t to_close = (1 << wl_list_length(&drm->outputs)) - 1;
uint64_t to_close = (1L << wl_list_length(&drm->outputs)) - 1;
struct wlr_drm_connector *conn;
wl_list_for_each(conn, &drm->outputs, link) {