* vga/igfx: fix integer overflow in datam calculation
@ 2016-06-30 9:46 qwx
2016-06-30 10:00 ` [9front] " cinap_lenrek
0 siblings, 1 reply; 2+ messages in thread
From: qwx @ 2016-06-30 9:46 UTC (permalink / raw)
To: 9front
vga/igfx: fix integer overflow in datam calculation
data[mn] and link[mn] are 24-bit values.
in the expression 'm = (n * ((freq * bpp)/8)) / (lsclk * lanes)',
uvlongs are used to prevent integer overflow, but since freq, bpp, lsclk and
lanes are all ints, the cast to uvlong does not happen until it's too late,
getting a wrong value.
instead, use u32int for m and n, and use casts where necessary.
example of bad calculation:
freq = 141400000
lsclk = 270000000
lanes = 2
bpp = 18
→ 0x7f3ee1ca6 (correct value: 0x4b69d0)
diff -r 0a3cf47fce65 sys/src/cmd/aux/vga/igfx.c
--- a/sys/src/cmd/aux/vga/igfx.c Mon Jun 27 00:36:54 2016 +0200
+++ b/sys/src/cmd/aux/vga/igfx.c Thu Jun 30 09:22:25 2016 +0300
@@ -692,16 +692,16 @@
static void
initdatalinkmn(Trans *t, int freq, int lsclk, int lanes, int tu, int bpp)
{
- uvlong m, n;
+ u32int m, n;
n = 0x800000;
- m = (n * ((freq * bpp)/8)) / (lsclk * lanes);
+ m = (n * (((uvlong)freq * bpp)/8)) / ((uvlong)lsclk * lanes);
t->dm[0].v = (tu-1)<<25 | m;
t->dn[0].v = n;
n = 0x80000;
- m = (n * freq) / lsclk;
+ m = ((uvlong)n * freq) / lsclk;
t->lm[0].v = m;
t->ln[0].v = n;
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [9front] vga/igfx: fix integer overflow in datam calculation
2016-06-30 9:46 vga/igfx: fix integer overflow in datam calculation qwx
@ 2016-06-30 10:00 ` cinap_lenrek
0 siblings, 0 replies; 2+ messages in thread
From: cinap_lenrek @ 2016-06-30 10:00 UTC (permalink / raw)
To: 9front
what was i thinking :-)
many thanks!
--
cinap
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-06-30 10:00 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-06-30 9:46 vga/igfx: fix integer overflow in datam calculation qwx
2016-06-30 10:00 ` [9front] " cinap_lenrek
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).