From: Alan Modra <amodra@gmail.com>
To: binutils@sourceware.org
Subject: NS32K arg_bufs uninitialised
Date: Sun, 22 Mar 2020 23:23:53 +1030 [thread overview]
Message-ID: <20200322125353.GO4583@bubble.grove.modra.org> (raw)
git commit d1e304bc27 was aimed at stopping uninitialised memory
access to the index_offset array. Unfortunately that patch resulted
in a different array being uninitialised for all instructions with
more than two arguments.
* ns32k-dis.c (print_insn_arg): Update comment.
(print_insn_ns32k): Reduce size of index_offset array, and
initialize, passing -1 to print_insn_arg for args that are not
an index. Don't exit arg loop early. Abort on bad arg number.
diff --git a/opcodes/ns32k-dis.c b/opcodes/ns32k-dis.c
index d505edd774..12df182d0a 100644
--- a/opcodes/ns32k-dis.c
+++ b/opcodes/ns32k-dis.c
@@ -446,7 +446,7 @@ invalid_float (float_type_u *p, int len)
bit position of the addressing extension. BUFFER contains the
instruction. ADDR is where BUFFER was read from. Put the disassembled
version of the operand in RESULT. INDEX_OFFSET is the bit position
- of the index byte (it contains garbage if this operand is not a
+ of the index byte (it contains -1 if this operand is not a
general operand using scaled indexed addressing mode). */
static int
@@ -790,10 +790,8 @@ print_insn_ns32k (bfd_vma memaddr, disassemble_info *info)
if (*d)
{
/* Offset in bits of the first thing beyond each index byte.
- Element 0 is for operand A and element 1 is for operand B.
- The rest are irrelevant, but we put them here so we don't
- index outside the array. */
- int index_offset[MAX_ARGS];
+ Element 0 is for operand A and element 1 is for operand B. */
+ int index_offset[2];
/* 0 for operand A, 1 for operand B, greater for other args. */
int whicharg = 0;
@@ -806,6 +804,8 @@ print_insn_ns32k (bfd_vma memaddr, disassemble_info *info)
if we are using scaled indexed addressing mode, since the index
bytes occur right after the basic instruction, not as part
of the addressing extension. */
+ index_offset[0] = -1;
+ index_offset[1] = -1;
if (Is_gen (d[1]))
{
int bitoff = d[1] == 'f' ? 10 : 5;
@@ -832,15 +832,16 @@ print_insn_ns32k (bfd_vma memaddr, disassemble_info *info)
while (*d)
{
argnum = *d - '1';
+ if (argnum >= MAX_ARGS)
+ abort ();
d++;
- if (argnum > maxarg && argnum < MAX_ARGS)
+ if (argnum > maxarg)
maxarg = argnum;
ioffset = print_insn_arg (*d, ioffset, &aoffset, buffer,
memaddr, arg_bufs[argnum],
- index_offset[whicharg]);
+ whicharg > 1 ? -1 : index_offset[whicharg]);
d++;
- if (whicharg++ >= 1)
- break;
+ whicharg++;
}
for (argnum = 0; argnum <= maxarg; argnum++)
--
Alan Modra
Australia Development Lab, IBM
reply other threads:[~2020-03-22 12:54 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200322125353.GO4583@bubble.grove.modra.org \
--to=amodra@gmail.com \
--cc=binutils@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).