Messages in this thread | | | Subject | Re: linux-5.3-rc4/drivers/staging/comedi/drivers/dt3000.c:373: (error) Signed integer overflow for expression 'divider*base' | From | Ian Abbott <> | Date | Mon, 12 Aug 2019 11:14:19 +0100 |
| |
On 12/08/2019 08:37, David Binderman wrote: > Hello there, > > Source code is > > prescale = 15; > base = timer_base * (1 << prescale); > divider = 65535; > *nanosec = divider * base; > > timer_base seems to be 500 or 100. > nanosec is a pointer to int, so it can only hold about 2,000,000,000 nanoseconds, or about 2 seconds.
Thanks for the report.
I couldn't reproduce the error with the compiler version I was using, but I can see that it is likely to result in an arithmetic overflow.
I think the main problem is that the line (in (dt3k_ns_to_timer()):
base = timer_base * (1 << prescale);
should be:
base = timer_base * (prescale + 1);
which matches the earlier instance of this calculation in the same function.
In practice, these lines of code should never be reached due to earlier range checks in dt3k_ai_cmdtest().
> Suggest rework code to use longs.
It wouldn't do any harm to change the `int` variables to `unsigned int`.
> > Regards > > David Binderman > > > time-_Base seems to be 50 or 100. >
-- -=( Ian Abbott <abbotti@mev.co.uk> || Web: www.mev.co.uk )=- -=( MEV Ltd. is a company registered in England & Wales. )=- -=( Registered number: 02862268. Registered address: )=- -=( 15 West Park Road, Bramhall, STOCKPORT, SK7 3JZ, UK. )=-
| |