aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPaolo Bonzini <pbonzini@redhat.com>2015-11-27 13:08:25 +0100
committerMichael Tokarev <mjt@tls.msk.ru>2015-12-04 09:39:55 +0300
commite0df8f18f755d8c976db9bca2faabb763ad98ff2 (patch)
tree0dd3afd06fdb2f9fae3cad65599fb3142ee30f2c
parent624533e5a53e5df347e46f06408d15b9df5254f0 (diff)
downloadqemu-e0df8f18f755d8c976db9bca2faabb763ad98ff2.tar.gz
qemu-e0df8f18f755d8c976db9bca2faabb763ad98ff2.tar.xz
qemu-e0df8f18f755d8c976db9bca2faabb763ad98ff2.zip
bt: avoid unintended sign extension
In the case of a 4-byte length, shifting a value by 24 may cause an unintended sign extension when converting from int to size_t. Use a uint32_t variable instead. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
-rw-r--r--hw/bt/sdp.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/hw/bt/sdp.c b/hw/bt/sdp.c
index b9bcdcc78..04eaecae6 100644
--- a/hw/bt/sdp.c
+++ b/hw/bt/sdp.c
@@ -42,7 +42,7 @@ struct bt_l2cap_sdp_state_s {
static ssize_t sdp_datalen(const uint8_t **element, ssize_t *left)
{
- size_t len = *(*element) ++ & SDP_DSIZE_MASK;
+ uint32_t len = *(*element) ++ & SDP_DSIZE_MASK;
if (!*left)
return -1;