commit b591dc59bc98ee558db4ca512aa117748ebfdeef
author Blue Swirl <blauwirbel@gmail.com> Sat May 14 14:03:22 2011 +0000
committer Blue Swirl <blauwirbel@gmail.com> Sun Jun 26 18:25:44 2011 +0000
tree 51eda8901a6cdf075292d9e2a4ff9cbf5430bba1
parent 614f104dfd2bf6d25170fb0afc086920cc7c407b

TCG: fix negative frame offset calculations

size_t is unsigned, so the frame offset calculations can be incorrect for
negative offsets.

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>

tcg/tcg.c

diff --git a/tcg/tcg.c b/tcg/tcg.c
index debf47f..d8bf721 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1439,13 +1439,17 @@
 {
     TCGTemp *ts;
     ts = &s->temps[temp];
-    s->current_frame_offset = (s->current_frame_offset + sizeof(tcg_target_long) - 1) & ~(sizeof(tcg_target_long) - 1);
-    if (s->current_frame_offset + sizeof(tcg_target_long) > s->frame_end)
+    s->current_frame_offset = (s->current_frame_offset +
+                               (tcg_target_long)sizeof(tcg_target_long) - 1) &
+        ~(sizeof(tcg_target_long) - 1);
+    if (s->current_frame_offset + (tcg_target_long)sizeof(tcg_target_long) >
+        s->frame_end) {
         tcg_abort();
+    }
     ts->mem_offset = s->current_frame_offset;
     ts->mem_reg = s->frame_reg;
     ts->mem_allocated = 1;
-    s->current_frame_offset += sizeof(tcg_target_long);
+    s->current_frame_offset += (tcg_target_long)sizeof(tcg_target_long);
 }
 
 /* free register 'reg' by spilling the corresponding temporary if necessary */