public inbox for gdb-testers@sourceware.org
help / color / mirror / Atom feed
* [binutils-gdb] H8300 use of uninitialised value
@ 2020-04-06 15:42 gdb-buildbot
  2020-04-06 15:42 ` Failures on Fedora-i686, branch master gdb-buildbot
                   ` (7 more replies)
  0 siblings, 8 replies; 9+ messages in thread
From: gdb-buildbot @ 2020-04-06 15:42 UTC (permalink / raw)
  To: gdb-testers

*** TEST RESULTS FOR COMMIT 57cb32b3c366585f7fafd6a741771ce826ba95f3 ***

commit 57cb32b3c366585f7fafd6a741771ce826ba95f3
Author:     Alan Modra <amodra@gmail.com>
AuthorDate: Sun Mar 22 20:26:31 2020 +1030
Commit:     Alan Modra <amodra@gmail.com>
CommitDate: Sun Mar 22 23:22:13 2020 +1030

    H8300 use of uninitialised value
    
            * h8300-dis.c (bfd_h8_disassemble): Limit data[] access to that
            successflly read from section.

diff --git a/opcodes/ChangeLog b/opcodes/ChangeLog
index eb3e4c32f2..4c05e849da 100644
--- a/opcodes/ChangeLog
+++ b/opcodes/ChangeLog
@@ -1,3 +1,8 @@
+2020-03-22  Alan Modra  <amodra@gmail.com>
+
+	* h8300-dis.c (bfd_h8_disassemble): Limit data[] access to that
+	successflly read from section.
+
 2020-03-22  Alan Modra  <amodra@gmail.com>
 
 	* arc-dis.c (find_format): Use ISO C string concatenation rather
diff --git a/opcodes/h8300-dis.c b/opcodes/h8300-dis.c
index 83a82c09bd..f5e00c40c1 100644
--- a/opcodes/h8300-dis.c
+++ b/opcodes/h8300-dis.c
@@ -327,7 +327,7 @@ bfd_h8_disassemble (bfd_vma addr, disassemble_info *info, int mach)
   const struct h8_instruction *qi;
   char const **pregnames = mach != 0 ? lregnames : wregnames;
   int status;
-  unsigned int l;
+  unsigned int maxlen;
   unsigned char data[MAX_CODE_NIBBLES];
   void *stream = info->stream;
   fprintf_ftype outfn = info->fprintf_func;
@@ -345,8 +345,8 @@ bfd_h8_disassemble (bfd_vma addr, disassemble_info *info, int mach)
       return -1;
     }
 
-  for (l = 2; status == 0 && l < sizeof (data) / 2; l += 2)
-    status = info->read_memory_func (addr + l, data + l, 2, info);
+  for (maxlen = 2; status == 0 && maxlen < sizeof (data) / 2; maxlen += 2)
+    status = info->read_memory_func (addr + maxlen, data + maxlen, 2, info);
 
   /* Find the exact opcode/arg combo.  */
   for (qi = h8_instructions; qi->opcode->name; qi++)
@@ -355,7 +355,7 @@ bfd_h8_disassemble (bfd_vma addr, disassemble_info *info, int mach)
       const op_type *nib = q->data.nib;
       unsigned int len = 0;
 
-      while (1)
+      while (len / 2 < maxlen)
 	{
 	  op_type looking_for = *nib;
 	  int thisnib = data[len / 2];
@@ -462,6 +462,22 @@ bfd_h8_disassemble (bfd_vma addr, disassemble_info *info, int mach)
 		       || (looking_for & MODE) == INDEXW
 		       || (looking_for & MODE) == INDEXL)
 		{
+		  int extra;
+		  switch (looking_for & SIZE)
+		    {
+		    case L_16:
+		    case L_16U:
+		      extra = 1;
+		      break;
+		    case L_32:
+		      extra = 3;
+		      break;
+		    default:
+		      extra = 0;
+		      break;
+		    }
+		  if (len / 2 + extra >= maxlen)
+		    break;
 		  extract_immediate (stream, looking_for, thisnib,
 				     data + len / 2, cst + opnr,
 				     cstlen + opnr, q);
@@ -516,6 +532,8 @@ bfd_h8_disassemble (bfd_vma addr, disassemble_info *info, int mach)
 	      else if ((looking_for & SIZE) == L_16
 		       || (looking_for & SIZE) == L_16U)
 		{
+		  if (len / 2 + 1 >= maxlen)
+		    break;
 		  cst[opnr] = (data[len / 2]) * 256 + data[(len + 2) / 2];
 		  cstlen[opnr] = 16;
 		}
@@ -529,8 +547,10 @@ bfd_h8_disassemble (bfd_vma addr, disassemble_info *info, int mach)
 		}
 	      else if ((looking_for & SIZE) == L_32)
 		{
-		  int i = len / 2;
+		  unsigned int i = len / 2;
 
+		  if (i + 3 >= maxlen)
+		    break;
 		  cst[opnr] = (((unsigned) data[i] << 24)
 			       | (data[i + 1] << 16)
 			       | (data[i + 2] << 8)
@@ -540,8 +560,10 @@ bfd_h8_disassemble (bfd_vma addr, disassemble_info *info, int mach)
 		}
 	      else if ((looking_for & SIZE) == L_24)
 		{
-		  int i = len / 2;
+		  unsigned int i = len / 2;
 
+		  if (i + 2 >= maxlen)
+		    break;
 		  cst[opnr] =
 		    (data[i] << 16) | (data[i + 1] << 8) | (data[i + 2]);
 		  cstlen[opnr] = 24;


^ permalink raw reply	[flat|nested] 9+ messages in thread
end of thread, other threads:[~2020-04-12  0:07 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-04-06 15:42 [binutils-gdb] H8300 use of uninitialised value gdb-buildbot
2020-04-06 15:42 ` Failures on Fedora-i686, branch master gdb-buildbot
2020-04-06 15:43 ` Failures on Fedora-x86_64-cc-with-index, " gdb-buildbot
2020-04-06 16:15 ` Failures on Fedora-x86_64-m64, " gdb-buildbot
2020-04-06 16:28 ` Failures on Fedora-x86_64-m32, " gdb-buildbot
2020-04-06 16:53 ` Failures on Fedora-x86_64-native-extended-gdbserver-m32, " gdb-buildbot
2020-04-06 17:21 ` Failures on Fedora-x86_64-native-extended-gdbserver-m64, " gdb-buildbot
2020-04-11  0:50 ` Failures on Fedora-x86_64-native-gdbserver-m64, " gdb-buildbot
2020-04-12  0:07 ` Failures on Ubuntu-Aarch64-native-extended-gdbserver-m64, " gdb-buildbot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).