From 255aeaa9a27bf9c2eab6db57a20153aa16947559 Mon Sep 17 00:00:00 2001 From: Yu-Ping Wu Date: Wed, 19 Feb 2020 11:55:34 +0800 Subject: libpayload: cbgfx: Fix potential overflowing expression BRANCH=none BUG=none TEST=none Change-Id: Icd37a6abc01d9fcbcf54525d47b15c9930a9b9fb Signed-off-by: Yu-Ping Wu Found-by: Coverity Scan #1419491 Reviewed-on: https://review.coreboot.org/c/coreboot/+/38987 Tested-by: build bot (Jenkins) Reviewed-by: Patrick Georgi --- payloads/libpayload/drivers/video/graphics.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'payloads/libpayload') diff --git a/payloads/libpayload/drivers/video/graphics.c b/payloads/libpayload/drivers/video/graphics.c index 8cb984b872..9494de31f5 100644 --- a/payloads/libpayload/drivers/video/graphics.c +++ b/payloads/libpayload/drivers/video/graphics.c @@ -349,8 +349,8 @@ int draw_rounded_box(const struct scale *pos_rel, const struct scale *dim_rel, /* Use 64 bits to avoid overflow */ int32_t x, y; uint64_t yy; - const uint64_t rrx = r.x * r.x, rry = r.y * r.y; - const uint64_t ssx = s.x * s.x, ssy = s.y * s.y; + const uint64_t rrx = (uint64_t)r.x * r.x, rry = (uint64_t)r.y * r.y; + const uint64_t ssx = (uint64_t)s.x * s.x, ssy = (uint64_t)s.y * s.y; x_begin = 0; x_end = 0; for (y = r.y - 1; y >= 0; y--) { @@ -358,7 +358,7 @@ int draw_rounded_box(const struct scale *pos_rel, const struct scale *dim_rel, * The inequality is valid in the beginning of each iteration: * y^2 + x_end^2 < r^2 */ - yy = y * y; + yy = (uint64_t)y * y; /* Check yy/ssy + xx/ssx < 1 */ while (yy * ssx + x_begin * x_begin * ssy < ssx * ssy) x_begin++; -- cgit v1.2.3