diff options
| author | H Hartley Sweeten <hsweeten@visionengravers.com> | 2015-02-20 12:52:27 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2015-03-01 18:47:39 -0800 |
| commit | 1f5fc964866dabec6db6e7eaf8865838b1436a8e (patch) | |
| tree | e9f6d7b170b64e91596fd9863ddc691b5d5ef10e /drivers/staging/comedi/drivers/cb_pcidas64.c | |
| parent | 4f456c8034ad993eb6908b8a53216bca7afe9f1f (diff) | |
staging: comedi: cb_pcidas64: fix possible integer overflow
The {min,max}_scan_divisor values could overflow due to the
unsigned int * insigned int calculation. Change the type of the
local variable 'convert_divisor' to unsigned long long to avoid
the possible overflow.
Reported-by: coverity (CID 200653)
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/comedi/drivers/cb_pcidas64.c')
| -rw-r--r-- | drivers/staging/comedi/drivers/cb_pcidas64.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/staging/comedi/drivers/cb_pcidas64.c b/drivers/staging/comedi/drivers/cb_pcidas64.c index 5b43e4e6d037..9836c877c910 100644 --- a/drivers/staging/comedi/drivers/cb_pcidas64.c +++ b/drivers/staging/comedi/drivers/cb_pcidas64.c @@ -2001,7 +2001,8 @@ static unsigned int get_divisor(unsigned int ns, unsigned int flags) static void check_adc_timing(struct comedi_device *dev, struct comedi_cmd *cmd) { const struct pcidas64_board *thisboard = dev->board_ptr; - unsigned int convert_divisor = 0, scan_divisor; + unsigned long long convert_divisor = 0; + unsigned int scan_divisor; static const int min_convert_divisor = 3; static const int max_convert_divisor = max_counter_value + min_convert_divisor; @@ -2027,7 +2028,6 @@ static void check_adc_timing(struct comedi_device *dev, struct comedi_cmd *cmd) if (cmd->scan_begin_src == TRIG_TIMER) { scan_divisor = get_divisor(cmd->scan_begin_arg, cmd->flags); if (cmd->convert_src == TRIG_TIMER) { - /* XXX check for integer overflows */ min_scan_divisor = convert_divisor * cmd->chanlist_len; max_scan_divisor = (convert_divisor * cmd->chanlist_len - 1) + |