Commit 1f5fc964 authored by H Hartley Sweeten's avatar H Hartley Sweeten Committed by Greg Kroah-Hartman

staging: comedi: cb_pcidas64: fix possible integer overflow

The {min,max}_scan_divisor values could overflow due to the
unsigned int * insigned int calculation. Change the type of the
local variable 'convert_divisor' to unsigned long long to avoid
the possible overflow.

Reported-by: coverity (CID 200653)
Signed-off-by: default avatarH Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: default avatarIan Abbott <abbotti@mev.co.uk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 4f456c80
...@@ -2001,7 +2001,8 @@ static unsigned int get_divisor(unsigned int ns, unsigned int flags) ...@@ -2001,7 +2001,8 @@ static unsigned int get_divisor(unsigned int ns, unsigned int flags)
static void check_adc_timing(struct comedi_device *dev, struct comedi_cmd *cmd) static void check_adc_timing(struct comedi_device *dev, struct comedi_cmd *cmd)
{ {
const struct pcidas64_board *thisboard = dev->board_ptr; const struct pcidas64_board *thisboard = dev->board_ptr;
unsigned int convert_divisor = 0, scan_divisor; unsigned long long convert_divisor = 0;
unsigned int scan_divisor;
static const int min_convert_divisor = 3; static const int min_convert_divisor = 3;
static const int max_convert_divisor = static const int max_convert_divisor =
max_counter_value + min_convert_divisor; max_counter_value + min_convert_divisor;
...@@ -2027,7 +2028,6 @@ static void check_adc_timing(struct comedi_device *dev, struct comedi_cmd *cmd) ...@@ -2027,7 +2028,6 @@ static void check_adc_timing(struct comedi_device *dev, struct comedi_cmd *cmd)
if (cmd->scan_begin_src == TRIG_TIMER) { if (cmd->scan_begin_src == TRIG_TIMER) {
scan_divisor = get_divisor(cmd->scan_begin_arg, cmd->flags); scan_divisor = get_divisor(cmd->scan_begin_arg, cmd->flags);
if (cmd->convert_src == TRIG_TIMER) { if (cmd->convert_src == TRIG_TIMER) {
/* XXX check for integer overflows */
min_scan_divisor = convert_divisor * cmd->chanlist_len; min_scan_divisor = convert_divisor * cmd->chanlist_len;
max_scan_divisor = max_scan_divisor =
(convert_divisor * cmd->chanlist_len - 1) + (convert_divisor * cmd->chanlist_len - 1) +
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment