From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 10 Jul 2025 17:43:12 +0000 (+0100)
Subject: hw/display/framebuffer: Add cast to force 64x64 multiply
X-Git-Tag: v10.1.0-rc2~6^2~4
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e7b77e681f8ecf7d9360e47243f7c1a0fb88f51c;p=thirdparty%2Fqemu.git

hw/display/framebuffer: Add cast to force 64x64 multiply

In framebuffer_update_display(), Coverity complains because we
multiply two values of type 'int' (which will be done as a 32x32
multiply and so in theory might overflow) and then add the result to
a ram_addr_t, which can be 64 bits.

4GB framebuffers are not plausible anyway, but keep Coverity happy
by adding casts which force these multiplies to be done as 64x64.

Coverity: CID 1487248
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-id: 20250710174312.1313177-1-peter.maydell@linaro.org
---

diff --git a/hw/display/framebuffer.c b/hw/display/framebuffer.c
index 4485aa335b..b4296e8a33 100644
--- a/hw/display/framebuffer.c
+++ b/hw/display/framebuffer.c
@@ -95,9 +95,9 @@ void framebuffer_update_display(
     }
     first = -1;
 
-    addr += i * src_width;
-    src += i * src_width;
-    dest += i * dest_row_pitch;
+    addr += (uint64_t)i * src_width;
+    src += (uint64_t)i * src_width;
+    dest += (uint64_t)i * dest_row_pitch;
 
     snap = memory_region_snapshot_and_clear_dirty(mem, addr, src_width * rows,
                                                   DIRTY_MEMORY_VGA);