summaryrefslogtreecommitdiff
path: root/payloads/libpayload
diff options
context:
space:
mode:
authorYu-Ping Wu <yupingso@google.com>2020-02-19 11:55:34 +0800
committerPatrick Georgi <pgeorgi@google.com>2020-02-24 13:05:51 +0000
commit255aeaa9a27bf9c2eab6db57a20153aa16947559 (patch)
treec65f4281c77bf4a0c286e696f7ef82ee2c8fbf12 /payloads/libpayload
parent8d1b0f1dbd2736391d4011106527a1e5b286307d (diff)
downloadcoreboot-255aeaa9a27bf9c2eab6db57a20153aa16947559.tar.xz
libpayload: cbgfx: Fix potential overflowing expression
BRANCH=none BUG=none TEST=none Change-Id: Icd37a6abc01d9fcbcf54525d47b15c9930a9b9fb Signed-off-by: Yu-Ping Wu <yupingso@google.com> Found-by: Coverity Scan #1419491 Reviewed-on: https://review.coreboot.org/c/coreboot/+/38987 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Patrick Georgi <pgeorgi@google.com>
Diffstat (limited to 'payloads/libpayload')
-rw-r--r--payloads/libpayload/drivers/video/graphics.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/payloads/libpayload/drivers/video/graphics.c b/payloads/libpayload/drivers/video/graphics.c
index 8cb984b872..9494de31f5 100644
--- a/payloads/libpayload/drivers/video/graphics.c
+++ b/payloads/libpayload/drivers/video/graphics.c
@@ -349,8 +349,8 @@ int draw_rounded_box(const struct scale *pos_rel, const struct scale *dim_rel,
/* Use 64 bits to avoid overflow */
int32_t x, y;
uint64_t yy;
- const uint64_t rrx = r.x * r.x, rry = r.y * r.y;
- const uint64_t ssx = s.x * s.x, ssy = s.y * s.y;
+ const uint64_t rrx = (uint64_t)r.x * r.x, rry = (uint64_t)r.y * r.y;
+ const uint64_t ssx = (uint64_t)s.x * s.x, ssy = (uint64_t)s.y * s.y;
x_begin = 0;
x_end = 0;
for (y = r.y - 1; y >= 0; y--) {
@@ -358,7 +358,7 @@ int draw_rounded_box(const struct scale *pos_rel, const struct scale *dim_rel,
* The inequality is valid in the beginning of each iteration:
* y^2 + x_end^2 < r^2
*/
- yy = y * y;
+ yy = (uint64_t)y * y;
/* Check yy/ssy + xx/ssx < 1 */
while (yy * ssx + x_begin * x_begin * ssy < ssx * ssy)
x_begin++;