public inbox for gdb-testers@sourceware.org help / color / mirror / Atom feed
From: gdb-buildbot@sergiodj.net To: gdb-testers@sourceware.org Subject: [binutils-gdb] H8300 use of uninitialised value Date: Mon, 06 Apr 2020 11:42:11 -0400 [thread overview] Message-ID: <57cb32b3c366585f7fafd6a741771ce826ba95f3@gdb-build> (raw) *** TEST RESULTS FOR COMMIT 57cb32b3c366585f7fafd6a741771ce826ba95f3 *** commit 57cb32b3c366585f7fafd6a741771ce826ba95f3 Author: Alan Modra <amodra@gmail.com> AuthorDate: Sun Mar 22 20:26:31 2020 +1030 Commit: Alan Modra <amodra@gmail.com> CommitDate: Sun Mar 22 23:22:13 2020 +1030 H8300 use of uninitialised value * h8300-dis.c (bfd_h8_disassemble): Limit data[] access to that successflly read from section. diff --git a/opcodes/ChangeLog b/opcodes/ChangeLog index eb3e4c32f2..4c05e849da 100644 --- a/opcodes/ChangeLog +++ b/opcodes/ChangeLog @@ -1,3 +1,8 @@ +2020-03-22 Alan Modra <amodra@gmail.com> + + * h8300-dis.c (bfd_h8_disassemble): Limit data[] access to that + successflly read from section. + 2020-03-22 Alan Modra <amodra@gmail.com> * arc-dis.c (find_format): Use ISO C string concatenation rather diff --git a/opcodes/h8300-dis.c b/opcodes/h8300-dis.c index 83a82c09bd..f5e00c40c1 100644 --- a/opcodes/h8300-dis.c +++ b/opcodes/h8300-dis.c @@ -327,7 +327,7 @@ bfd_h8_disassemble (bfd_vma addr, disassemble_info *info, int mach) const struct h8_instruction *qi; char const **pregnames = mach != 0 ? lregnames : wregnames; int status; - unsigned int l; + unsigned int maxlen; unsigned char data[MAX_CODE_NIBBLES]; void *stream = info->stream; fprintf_ftype outfn = info->fprintf_func; @@ -345,8 +345,8 @@ bfd_h8_disassemble (bfd_vma addr, disassemble_info *info, int mach) return -1; } - for (l = 2; status == 0 && l < sizeof (data) / 2; l += 2) - status = info->read_memory_func (addr + l, data + l, 2, info); + for (maxlen = 2; status == 0 && maxlen < sizeof (data) / 2; maxlen += 2) + status = info->read_memory_func (addr + maxlen, data + maxlen, 2, info); /* Find the exact opcode/arg combo. */ for (qi = h8_instructions; qi->opcode->name; qi++) @@ -355,7 +355,7 @@ bfd_h8_disassemble (bfd_vma addr, disassemble_info *info, int mach) const op_type *nib = q->data.nib; unsigned int len = 0; - while (1) + while (len / 2 < maxlen) { op_type looking_for = *nib; int thisnib = data[len / 2]; @@ -462,6 +462,22 @@ bfd_h8_disassemble (bfd_vma addr, disassemble_info *info, int mach) || (looking_for & MODE) == INDEXW || (looking_for & MODE) == INDEXL) { + int extra; + switch (looking_for & SIZE) + { + case L_16: + case L_16U: + extra = 1; + break; + case L_32: + extra = 3; + break; + default: + extra = 0; + break; + } + if (len / 2 + extra >= maxlen) + break; extract_immediate (stream, looking_for, thisnib, data + len / 2, cst + opnr, cstlen + opnr, q); @@ -516,6 +532,8 @@ bfd_h8_disassemble (bfd_vma addr, disassemble_info *info, int mach) else if ((looking_for & SIZE) == L_16 || (looking_for & SIZE) == L_16U) { + if (len / 2 + 1 >= maxlen) + break; cst[opnr] = (data[len / 2]) * 256 + data[(len + 2) / 2]; cstlen[opnr] = 16; } @@ -529,8 +547,10 @@ bfd_h8_disassemble (bfd_vma addr, disassemble_info *info, int mach) } else if ((looking_for & SIZE) == L_32) { - int i = len / 2; + unsigned int i = len / 2; + if (i + 3 >= maxlen) + break; cst[opnr] = (((unsigned) data[i] << 24) | (data[i + 1] << 16) | (data[i + 2] << 8) @@ -540,8 +560,10 @@ bfd_h8_disassemble (bfd_vma addr, disassemble_info *info, int mach) } else if ((looking_for & SIZE) == L_24) { - int i = len / 2; + unsigned int i = len / 2; + if (i + 2 >= maxlen) + break; cst[opnr] = (data[i] << 16) | (data[i + 1] << 8) | (data[i + 2]); cstlen[opnr] = 24;
next reply other threads:[~2020-04-06 15:42 UTC|newest] Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-04-06 15:42 gdb-buildbot [this message] 2020-04-06 15:42 ` Failures on Fedora-i686, branch master gdb-buildbot 2020-04-06 15:43 ` Failures on Fedora-x86_64-cc-with-index, " gdb-buildbot 2020-04-06 16:15 ` Failures on Fedora-x86_64-m64, " gdb-buildbot 2020-04-06 16:28 ` Failures on Fedora-x86_64-m32, " gdb-buildbot 2020-04-06 16:53 ` Failures on Fedora-x86_64-native-extended-gdbserver-m32, " gdb-buildbot 2020-04-06 17:21 ` Failures on Fedora-x86_64-native-extended-gdbserver-m64, " gdb-buildbot 2020-04-11 0:50 ` Failures on Fedora-x86_64-native-gdbserver-m64, " gdb-buildbot 2020-04-12 0:07 ` Failures on Ubuntu-Aarch64-native-extended-gdbserver-m64, " gdb-buildbot
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=57cb32b3c366585f7fafd6a741771ce826ba95f3@gdb-build \ --to=gdb-buildbot@sergiodj.net \ --cc=gdb-testers@sourceware.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).