From c6086f3a5484cf5e318e11bd6340a9934126f121 Mon Sep 17 00:00:00 2001 From: Pierre-Eric Pelloux-Prayer Date: Fri, 27 Jun 2025 10:54:50 +0200 Subject: [PATCH] frontends/va: fix potential overflows MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The multiplication of 32 bits integers will be truncated before being widened to the destination variable' size. Reported by static analysis. Reviewed-by: Marek Olšák Part-of: --- src/gallium/frontends/va/buffer.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/gallium/frontends/va/buffer.c b/src/gallium/frontends/va/buffer.c index b5a199cfa42..2102e2df646 100644 --- a/src/gallium/frontends/va/buffer.c +++ b/src/gallium/frontends/va/buffer.c @@ -68,7 +68,7 @@ vlVaCreateBuffer(VADriverContextP ctx, VAContextID context, VABufferType type, if (buf->type == VAEncCodedBufferType) buf->data = CALLOC(1, sizeof(VACodedBufferSegment)); else - buf->data = MALLOC(size * num_elements); + buf->data = MALLOC((size_t)size * num_elements); if (!buf->data) { FREE(buf); @@ -76,7 +76,7 @@ vlVaCreateBuffer(VADriverContextP ctx, VAContextID context, VABufferType type, } if (data) - memcpy(buf->data, data, size * num_elements); + memcpy(buf->data, data, (size_t)size * num_elements); drv = VL_VA_DRIVER(ctx); mtx_lock(&drv->mutex); @@ -482,7 +482,7 @@ vlVaAcquireBufferHandle(VADriverContextP ctx, VABufferID buf_id, buf_info->type = buf->type; buf_info->mem_type = mem_type; - buf_info->mem_size = buf->num_elements * buf->size; + buf_info->mem_size = buf->num_elements * (size_t)buf->size; } buf->export_refcount++;