From 13a409bacd4862293c4d65e8bef662779e5a0e47 Mon Sep 17 00:00:00 2001 Message-Id: In-Reply-To: References: From: Blue Swirl Date: Sat, 14 May 2011 14:03:22 +0000 Subject: [PATCH 05/11] TCG: fix negative frame offset calculations size_t is unsigned, so the frame offset calculations can be incorrect for negative offsets. Signed-off-by: Blue Swirl --- tcg/tcg.c | 10 +++++++--- 1 files changed, 7 insertions(+), 3 deletions(-) diff --git a/tcg/tcg.c b/tcg/tcg.c index 8748c05..75972c3 100644 --- a/tcg/tcg.c +++ b/tcg/tcg.c @@ -1434,13 +1434,17 @@ static void temp_allocate_frame(TCGContext *s, int temp) { TCGTemp *ts; ts = &s->temps[temp]; - s->current_frame_offset = (s->current_frame_offset + sizeof(tcg_target_long) - 1) & ~(sizeof(tcg_target_long) - 1); - if (s->current_frame_offset + sizeof(tcg_target_long) > s->frame_end) + s->current_frame_offset = (s->current_frame_offset + + (tcg_target_long)sizeof(tcg_target_long) - 1) & + ~(sizeof(tcg_target_long) - 1); + if (s->current_frame_offset + (tcg_target_long)sizeof(tcg_target_long) > + s->frame_end) { tcg_abort(); + } ts->mem_offset = s->current_frame_offset; ts->mem_reg = s->frame_reg; ts->mem_allocated = 1; - s->current_frame_offset += sizeof(tcg_target_long); + s->current_frame_offset += (tcg_target_long)sizeof(tcg_target_long); } /* free register 'reg' by spilling the corresponding temporary if necessary */ -- 1.7.2.5