* [Bug Report] drivers/video/fbdev/da8xx-fb.c: undefined behavior when left shifting
@ 2020-05-22 3:01 Changming Liu
0 siblings, 0 replies; only message in thread
From: Changming Liu @ 2020-05-22 3:01 UTC (permalink / raw)
To: b.zolnierkie; +Cc: linux-fbdev, Lu, Long, dri-devel, yaohway
Greetings, it's me again, I sent you a bug report yesterday, I hope that find you well.
This time I found that in /drivers/video/fbdev/da8xx-fb.c
function lcd_cfg_vertical_sync, there might be an undefined result by left shifting.
More specifically, in function lcd_cfg_vertical_sync, line 437. back_porch is a signed integer
which might come from user space. And it's logic AND with string literal 0xff. The result is then left shifted by 24 bits.
The problem is, since the logic AND produce a signed integer and the result of left shifting this signed integer
(whose lowest 8 bits not cleared) by 24 bits is undefined when its 8th bit is 1. Similar patterns can be found in line 410 as well.
I wonder if this bug is worth fixing? This can help me understand linux and UB a lot.
Looking forward to you valuable response.
dri-devel mailing list
^ permalink raw reply [flat|nested] only message in thread
only message in thread, back to index
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-22 3:01 [Bug Report] drivers/video/fbdev/da8xx-fb.c: undefined behavior when left shifting Changming Liu
dri-devel Archive on lore.kernel.org
Archives are clonable:
git clone --mirror https://lore.kernel.org/dri-devel/0 dri-devel/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 dri-devel dri-devel/ https://lore.kernel.org/dri-devel \
Example config snippet for mirrors
Newsgroup available over NNTP:
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git