On 4/1/22 11:46, Richard Henderson wrote:
Coverity warns that 14 << data32 may overflow with respect
to the target_ulong to which it is subsequently added.
We know this wasn't true because data32 is in [1,2],
but the suggested fix is perfectly fine.
Fixes: Coverity CID 1487135, 1487256
Signed-off-by: Richard Henderson <richard.hender...@linaro.org>
---
target/i386/tcg/fpu_helper.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
index ebf5e73df9..30bc44fcf8 100644
--- a/target/i386/tcg/fpu_helper.c
+++ b/target/i386/tcg/fpu_helper.c
@@ -2466,7 +2466,7 @@ static void do_fsave(CPUX86State *env, target_ulong ptr,
int data32,
do_fstenv(env, ptr, data32, retaddr);
- ptr += (14 << data32);
+ ptr += (target_ulong)14 << data32;
for (i = 0; i < 8; i++) {
tmp = ST(i);
do_fstt(env, tmp, ptr, retaddr);
@@ -2488,7 +2488,7 @@ static void do_frstor(CPUX86State *env, target_ulong ptr,
int data32,
int i;
do_fldenv(env, ptr, data32, retaddr);
- ptr += (14 << data32);
+ ptr += (target_ulong)14 << data32;
for (i = 0; i < 8; i++) {
tmp = do_fldt(env, ptr, retaddr);
Queuing to tcg-next.
r~
