From: "mark at klomp dot org" <sourceware-bugzilla@sourceware.org>
To: elfutils-devel@sourceware.org
Subject: [Bug libasm/25068] Several crashes inside libasm
Date: Wed, 16 Oct 2019 13:21:00 -0000 [thread overview]
Message-ID: <bug-25068-10460-IWetxciy5j@http.sourceware.org/bugzilla/> (raw)
In-Reply-To: <bug-25068-10460@http.sourceware.org/bugzilla/>
https://sourceware.org/bugzilla/show_bug.cgi?id=25068
Mark Wielaard <mark at klomp dot org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |ASSIGNED
Last reconfirmed| |2019-10-16
CC| |mark at klomp dot org
Ever confirmed|0 |1
--- Comment #1 from Mark Wielaard <mark at klomp dot org> ---
Thanks for the example crashes. These seem caused by 2 asserts, a missing
bounds check and an off-by-one bounds check. Which should be resolved by the
following patch:
diff --git a/libcpu/i386_data.h b/libcpu/i386_data.h
index b8a34c3e..06356b8a 100644
--- a/libcpu/i386_data.h
+++ b/libcpu/i386_data.h
@@ -1336,7 +1336,7 @@ FCT_sel (struct output_data *d)
{
assert (d->opoff1 % 8 == 0);
assert (d->opoff1 / 8 == 5);
- if (*d->param_start + 2 > d->end)
+ if (*d->param_start + 2 >= d->end)
return -1;
*d->param_start += 2;
uint16_t absval = read_2ubyte_unaligned (&d->data[5]);
diff --git a/libcpu/i386_disasm.c b/libcpu/i386_disasm.c
index 8a206398..4422ffa2 100644
--- a/libcpu/i386_disasm.c
+++ b/libcpu/i386_disasm.c
@@ -610,7 +610,9 @@ i386_disasm (Ebl *ebl __attribute__((unused)),
/* Account for displacement. */
if ((modrm & 0xc7) == 5 || (modrm & 0xc0) == 0x80
- || ((modrm & 0xc7) == 0x4 && (codep[0] & 0x7) == 0x5))
+ || ((modrm & 0xc7) == 0x4
+ && param_start < end
+ && (codep[0] & 0x7) == 0x5))
param_start += 4;
else if ((modrm & 0xc0) == 0x40)
param_start += 1;
@@ -821,7 +823,8 @@ i386_disasm (Ebl *ebl __attribute__((unused)),
}
FALLTHROUGH;
default:
- assert (! "INVALID not handled");
+ str = "INVALID not handled";
+ break;
}
}
else
@@ -1124,8 +1127,9 @@ i386_disasm (Ebl *ebl __attribute__((unused)),
/* Invalid (or at least unhandled) opcode. */
if (prefixes != 0)
goto print_prefix;
- assert (*startp == data);
- ++data;
+ /* Make sure we get past the unrecognized opcode if we haven't yet. */
+ if (*startp == data)
+ ++data;
ADD_STRING ("(bad)");
addr += data - begin;
--
You are receiving this mail because:
You are on the CC list for the bug.
next prev parent reply other threads:[~2019-10-16 13:21 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-06 15:08 [Bug libasm/25068] New: " leftcopy.chx at gmail dot com
2019-10-16 13:21 ` mark at klomp dot org [this message]
2019-10-26 0:35 ` [Bug libasm/25068] " mark at klomp dot org
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bug-25068-10460-IWetxciy5j@http.sourceware.org/bugzilla/ \
--to=sourceware-bugzilla@sourceware.org \
--cc=elfutils-devel@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).