From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pg1-x52c.google.com (mail-pg1-x52c.google.com [IPv6:2607:f8b0:4864:20::52c]) by sourceware.org (Postfix) with ESMTPS id 314F3385BF9F for ; Sun, 22 Mar 2020 12:54:00 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 314F3385BF9F Received: by mail-pg1-x52c.google.com with SMTP id k191so4550599pgc.13 for ; Sun, 22 Mar 2020 05:54:00 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:subject:message-id:mime-version :content-disposition:user-agent; bh=oAQ+N4b9hRnc/DRRWdkbQ94sEIrpRl9SNCShOS43In8=; b=ocu+oJFwEnewed4JfX53o9njDReKwSt2myoZyDhcKieZRsTUHRO/TZXRGwWLutZ3Bm bRu4zmhFiGP6j6+79wkmDTQIOHc4EqJQMq+PtxYp9WU7XHyjdopZmz8C7KBEC9yKAW2z bxVWcF60t4sAQONaIM1FCmjPpYkwIw6BxhdiPg/Kh/iBK05JLTpoGzgENciHJ6tfz2zz UJWTUWpa8P96UPWeIuM/WI2C1Mj4ac8jlqDbp/+C675DCLWXR9KWJCHiLVekw5rYAC2D jktwce3VlWr7rw4r0SopYLfckB8CLxr5x4ApV0XsHnhIvPHhtwBKxj0nDG6cHLvNaJ1K a8tQ== X-Gm-Message-State: ANhLgQ0mmyPhzqTQGS09Sec3j6pKWoFDiHjrSBMyc4voZWnWzDqk0QrK GkpsQ7iBtdWp5eHGhT/SUfBCPKh7d0Q= X-Google-Smtp-Source: ADFU+vuD3uhUkcKPFRikElvn5QKxgcjvlLGyErhkQm8V3tMfL7ueaU0tuM4V46bb/SfVB7AcofTmcw== X-Received: by 2002:a63:2901:: with SMTP id p1mr375413pgp.444.1584881638983; Sun, 22 Mar 2020 05:53:58 -0700 (PDT) Received: from bubble.grove.modra.org (158.106.96.58.static.exetel.com.au. [58.96.106.158]) by smtp.gmail.com with ESMTPSA id x66sm10099471pgb.9.2020.03.22.05.53.57 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 22 Mar 2020 05:53:58 -0700 (PDT) Received: by bubble.grove.modra.org (Postfix, from userid 1000) id 9479E88E40; Sun, 22 Mar 2020 23:23:53 +1030 (ACDT) Date: Sun, 22 Mar 2020 23:23:53 +1030 From: Alan Modra To: binutils@sourceware.org Subject: NS32K arg_bufs uninitialised Message-ID: <20200322125353.GO4583@bubble.grove.modra.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.9.4 (2018-02-28) X-Spam-Status: No, score=-30.0 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, GIT_PATCH_1, GIT_PATCH_2, GIT_PATCH_3, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 22 Mar 2020 12:54:01 -0000 git commit d1e304bc27 was aimed at stopping uninitialised memory access to the index_offset array. Unfortunately that patch resulted in a different array being uninitialised for all instructions with more than two arguments. * ns32k-dis.c (print_insn_arg): Update comment. (print_insn_ns32k): Reduce size of index_offset array, and initialize, passing -1 to print_insn_arg for args that are not an index. Don't exit arg loop early. Abort on bad arg number. diff --git a/opcodes/ns32k-dis.c b/opcodes/ns32k-dis.c index d505edd774..12df182d0a 100644 --- a/opcodes/ns32k-dis.c +++ b/opcodes/ns32k-dis.c @@ -446,7 +446,7 @@ invalid_float (float_type_u *p, int len) bit position of the addressing extension. BUFFER contains the instruction. ADDR is where BUFFER was read from. Put the disassembled version of the operand in RESULT. INDEX_OFFSET is the bit position - of the index byte (it contains garbage if this operand is not a + of the index byte (it contains -1 if this operand is not a general operand using scaled indexed addressing mode). */ static int @@ -790,10 +790,8 @@ print_insn_ns32k (bfd_vma memaddr, disassemble_info *info) if (*d) { /* Offset in bits of the first thing beyond each index byte. - Element 0 is for operand A and element 1 is for operand B. - The rest are irrelevant, but we put them here so we don't - index outside the array. */ - int index_offset[MAX_ARGS]; + Element 0 is for operand A and element 1 is for operand B. */ + int index_offset[2]; /* 0 for operand A, 1 for operand B, greater for other args. */ int whicharg = 0; @@ -806,6 +804,8 @@ print_insn_ns32k (bfd_vma memaddr, disassemble_info *info) if we are using scaled indexed addressing mode, since the index bytes occur right after the basic instruction, not as part of the addressing extension. */ + index_offset[0] = -1; + index_offset[1] = -1; if (Is_gen (d[1])) { int bitoff = d[1] == 'f' ? 10 : 5; @@ -832,15 +832,16 @@ print_insn_ns32k (bfd_vma memaddr, disassemble_info *info) while (*d) { argnum = *d - '1'; + if (argnum >= MAX_ARGS) + abort (); d++; - if (argnum > maxarg && argnum < MAX_ARGS) + if (argnum > maxarg) maxarg = argnum; ioffset = print_insn_arg (*d, ioffset, &aoffset, buffer, memaddr, arg_bufs[argnum], - index_offset[whicharg]); + whicharg > 1 ? -1 : index_offset[whicharg]); d++; - if (whicharg++ >= 1) - break; + whicharg++; } for (argnum = 0; argnum <= maxarg; argnum++) -- Alan Modra Australia Development Lab, IBM