There's a potential arith overflow in npcm7xx_pwm_calculate_duty. This patch fixes it.
Thanks Peter for finding this out. Signed-off-by: Hao Wu <wuhao...@google.com> --- hw/misc/npcm7xx_pwm.c | 4 ++-- tests/qtest/npcm7xx_pwm-test.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/hw/misc/npcm7xx_pwm.c b/hw/misc/npcm7xx_pwm.c index e99e3cc7ef..90b4f630a0 100644 --- a/hw/misc/npcm7xx_pwm.c +++ b/hw/misc/npcm7xx_pwm.c @@ -102,9 +102,9 @@ static uint32_t npcm7xx_pwm_calculate_duty(NPCM7xxPWM *p) if (p->cnr == 0) { duty = 0; } else if (p->cmr >= p->cnr) { - duty = NPCM7XX_PWM_MAX_DUTY; + duty = (uint64_t)NPCM7XX_PWM_MAX_DUTY; } else { - duty = NPCM7XX_PWM_MAX_DUTY * (p->cmr + 1) / (p->cnr + 1); + duty = (uint64_t)NPCM7XX_PWM_MAX_DUTY * (p->cmr + 1) / (p->cnr + 1); } } else { duty = 0; diff --git a/tests/qtest/npcm7xx_pwm-test.c b/tests/qtest/npcm7xx_pwm-test.c index 63557d2c06..f55571b31d 100644 --- a/tests/qtest/npcm7xx_pwm-test.c +++ b/tests/qtest/npcm7xx_pwm-test.c @@ -280,7 +280,7 @@ static uint64_t pwm_compute_duty(uint32_t cnr, uint32_t cmr, bool inverted) } else if (cmr >= cnr) { duty = MAX_DUTY; } else { - duty = MAX_DUTY * (cmr + 1) / (cnr + 1); + duty = (uint64_t)MAX_DUTY * (cmr + 1) / (cnr + 1); } if (inverted) { -- 2.30.0.280.ga3ce27912f-goog