AlexIndustrial/mesa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

frontends/va: fix potential overflows

Browse Source 
The multiplication of 32 bits integers will be truncated before
being widened to the destination variable' size.
Reported by static analysis.

Reviewed-by: Marek Olšák <marek.olsak@amd.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/35877>
This commit is contained in:
Pierre-Eric Pelloux-Prayer
2025-06-27 10:54:50 +02:00
committed by Marge Bot
parent f7890c0df9
commit c6086f3a54
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/gallium/frontends/va/buffer.c
+3 -3
View File
@@ -68,7 +68,7 @@ vlVaCreateBuffer(VADriverContextP ctx, VAContextID context, VABufferType type,
if (buf->type == VAEncCodedBufferType)
buf->data = CALLOC(1, sizeof(VACodedBufferSegment));
else
buf->data = MALLOC(size * num_elements);
buf->data = MALLOC((size_t)size * num_elements);
if (!buf->data) {
FREE(buf);
@@ -76,7 +76,7 @@ vlVaCreateBuffer(VADriverContextP ctx, VAContextID context, VABufferType type,
}
if (data)
memcpy(buf->data, data, size * num_elements);
memcpy(buf->data, data, (size_t)size * num_elements);
drv = VL_VA_DRIVER(ctx);
mtx_lock(&drv->mutex);
@@ -482,7 +482,7 @@ vlVaAcquireBufferHandle(VADriverContextP ctx, VABufferID buf_id,
buf_info->type = buf->type;
buf_info->mem_type = mem_type;
buf_info->mem_size = buf->num_elements * buf->size;
buf_info->mem_size = buf->num_elements * (size_t)buf->size;
}
buf->export_refcount++;