The current code compare i (int) with req->count (uint32_t) in a for loop, risking an infinite loop if req->count is equal to UINT_MAX.
Also i is only used in comparisons or multiplications with unsigned integers. Signed-off-by: Stefano Stabellini <[email protected]> Cc: Dongxiao Xu <[email protected]> Cc: Stefano Stabellini <[email protected]> Signed-off-by: Ian Jackson <[email protected]> --- xen-all.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/xen-all.c b/xen-all.c index 97c8ef4..aabbb80 100644 --- a/xen-all.c +++ b/xen-all.c @@ -717,7 +717,7 @@ static inline void write_phys_req_item(hwaddr addr, static void cpu_ioreq_pio(ioreq_t *req) { - int i; + uint32_t i; if (req->dir == IOREQ_READ) { if (!req->data_is_ptr) { @@ -746,7 +746,7 @@ static void cpu_ioreq_pio(ioreq_t *req) static void cpu_ioreq_move(ioreq_t *req) { - int i; + uint32_t i; if (!req->data_is_ptr) { if (req->dir == IOREQ_READ) { -- 1.7.2.5
