From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=192.55.52.43; helo=mga05.intel.com; envelope-from=hao.a.wu@intel.com; receiver=edk2-devel@lists.01.org Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 7B15621EC8D0B for ; Wed, 27 Sep 2017 21:29:11 -0700 (PDT) Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga105.fm.intel.com with ESMTP; 27 Sep 2017 21:32:25 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.42,448,1500966000"; d="scan'208";a="1224629837" Received: from shwdeopenpsi014.ccr.corp.intel.com ([10.239.9.13]) by fmsmga002.fm.intel.com with ESMTP; 27 Sep 2017 21:32:24 -0700 From: Hao Wu To: edk2-devel@lists.01.org Cc: Hao Wu , Steven Shi , Star Zeng , Eric Dong Date: Thu, 28 Sep 2017 12:32:13 +0800 Message-Id: <20170928043213.20776-6-hao.a.wu@intel.com> X-Mailer: git-send-email 2.12.0.windows.1 In-Reply-To: <20170928043213.20776-1-hao.a.wu@intel.com> References: <20170928043213.20776-1-hao.a.wu@intel.com> Subject: [PATCH v3 5/5] MdeModulePkg/AtaAtapiPassThru: Fix possible out of range left shift X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Sep 2017 04:29:11 -0000 REF: https://bugzilla.tianocore.org/show_bug.cgi?id=699 Within function AhciModeInitialization(), left shift operations of 'BIT0' in the following statements: "if ((PortImplementBitMap & (BIT0 << Port)) != 0) {" will incur possible out of range left shift when Port is 31, since "1 << 31" is possible to exceed the range of type 'int' (signed). According to the C11 spec, Section 6.5.7: > 4 The result of E1 << E2 is E1 left-shifted E2 bit positions; vacated > bits are filled with zeros. If E1 has an unsigned type, the value > of the result is E1 * 2^E2 , reduced modulo one more than the > maximum value representable in the result type. If E1 has a signed > type and nonnegative value, and E1 * 2^E2 is representable in the > result type, then that is the resulting value; otherwise, the > behavior is undefined. This commit explicitly cast 'BIT0' with UINT32 to resolve this issue. Cc: Steven Shi Cc: Star Zeng Cc: Eric Dong Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Hao Wu --- MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AhciMode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AhciMode.c b/MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AhciMode.c index b954de8101..e6de5d65bc 100644 --- a/MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AhciMode.c +++ b/MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AhciMode.c @@ -1,7 +1,7 @@ /** @file The file for AHCI mode of ATA host controller. - Copyright (c) 2010 - 2016, Intel Corporation. All rights reserved.
+ Copyright (c) 2010 - 2017, Intel Corporation. All rights reserved.
(C) Copyright 2015 Hewlett Packard Enterprise Development LP
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD License @@ -2314,7 +2314,7 @@ AhciModeInitialization ( } for (Port = 0; Port < EFI_AHCI_MAX_PORTS; Port ++) { - if ((PortImplementBitMap & (BIT0 << Port)) != 0) { + if ((PortImplementBitMap & (((UINT32)BIT0) << Port)) != 0) { // // According to AHCI spec, MaxPortNumber should be equal or greater than the number of implemented ports. // -- 2.12.0.windows.1