9front - general discussion about 9front
 help / color / mirror / Atom feed
* vga/igfx: fix integer overflow in datam calculation
@ 2016-06-30  9:46 qwx
  2016-06-30 10:00 ` [9front] " cinap_lenrek
  0 siblings, 1 reply; 2+ messages in thread
From: qwx @ 2016-06-30  9:46 UTC (permalink / raw)
  To: 9front

vga/igfx: fix integer overflow in datam calculation

data[mn] and link[mn] are 24-bit values.
in the expression 'm = (n * ((freq * bpp)/8)) / (lsclk * lanes)',
uvlongs are used to prevent integer overflow, but since freq, bpp, lsclk and
lanes are all ints, the cast to uvlong does not happen until it's too late,
getting a wrong value.
instead, use u32int for m and n, and use casts where necessary.

example of bad calculation:
freq = 141400000
lsclk = 270000000
lanes = 2
bpp = 18
→ 0x7f3ee1ca6 (correct value: 0x4b69d0)

diff -r 0a3cf47fce65 sys/src/cmd/aux/vga/igfx.c
--- a/sys/src/cmd/aux/vga/igfx.c	Mon Jun 27 00:36:54 2016 +0200
+++ b/sys/src/cmd/aux/vga/igfx.c	Thu Jun 30 09:22:25 2016 +0300
@@ -692,16 +692,16 @@
 static void
 initdatalinkmn(Trans *t, int freq, int lsclk, int lanes, int tu, int bpp)
 {
-	uvlong m, n;
+	u32int m, n;
 
 	n = 0x800000;
-	m = (n * ((freq * bpp)/8)) / (lsclk * lanes);
+	m = (n * (((uvlong)freq * bpp)/8)) / ((uvlong)lsclk * lanes);
 
 	t->dm[0].v = (tu-1)<<25 | m;
 	t->dn[0].v = n;
 
 	n = 0x80000;
-	m = (n * freq) / lsclk;
+	m = ((uvlong)n * freq) / lsclk;
 
 	t->lm[0].v = m;
 	t->ln[0].v = n;


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [9front] vga/igfx: fix integer overflow in datam calculation
  2016-06-30  9:46 vga/igfx: fix integer overflow in datam calculation qwx
@ 2016-06-30 10:00 ` cinap_lenrek
  0 siblings, 0 replies; 2+ messages in thread
From: cinap_lenrek @ 2016-06-30 10:00 UTC (permalink / raw)
  To: 9front

what was i thinking :-)

many thanks!

--
cinap


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2016-06-30 10:00 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-06-30  9:46 vga/igfx: fix integer overflow in datam calculation qwx
2016-06-30 10:00 ` [9front] " cinap_lenrek

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).