hw/arm/aspeed: avoid sign mismatch on sscanf for uart property
using "%u" with sscanf() was likely meant to indicate that a negative value was unexpected, but with a signed variable it could result in undefined behaviour. use "%d" and check for a negative input explicitly. Signed-off-by: Carlo Marcelo Arenas Belón <carenas@gmail.com> Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20260802162828.16880-1-carenas@gmail.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
Carlo Marcelo Arenas Belón committed
Aug 2, 2026 at 09:28 UTC
1d06e84aa75e880ba1e859c6ee157306702ab3c1
1 file changed
+1
-1
hw/arm/aspeed.c
+1
-1
@@ -327,7 +327,7 @@ static void aspeed_set_bmc_console(Object *obj, const char *value, Error **errp)
327
int uart_first = aspeed_uart_first(sc->uarts_base);
328
int uart_last = aspeed_uart_last(sc->uarts_base, sc->uarts_num);
329
330
- if (sscanf(value, "uart%u", &val) != 1) {
330
+ if (sscanf(value, "uart%d", &val) != 1 || val < 0) {
331
error_setg(errp, "Bad value for \"uart\" property");
332
return;
333
}