diff options
| author | Alan Modra <amodra@gmail.com> | 2020-03-22 18:15:41 +1030 |
|---|---|---|
| committer | Alan Modra <amodra@gmail.com> | 2020-03-22 23:22:13 +1030 |
| commit | 03704c7704870a0e6cbb0eae99488d544c4adb30 (patch) | |
| tree | 6f74ee9792cb6f11a7e1a8386845c0499610cb2d /opcodes | |
| parent | d1023b5d1e4483e5fa3bdab97bc041e1b1c05c5d (diff) | |
| download | fsf-binutils-gdb-03704c7704870a0e6cbb0eae99488d544c4adb30.zip fsf-binutils-gdb-03704c7704870a0e6cbb0eae99488d544c4adb30.tar.gz fsf-binutils-gdb-03704c7704870a0e6cbb0eae99488d544c4adb30.tar.bz2 | |
NS32K arg_bufs uninitialised
git commit d1e304bc27 was aimed at stopping uninitialised memory
access to the index_offset array. Unfortunately that patch resulted
in a different array being uninitialised for all instructions with
more than two arguments.
* ns32k-dis.c (print_insn_arg): Update comment.
(print_insn_ns32k): Reduce size of index_offset array, and
initialize, passing -1 to print_insn_arg for args that are not
an index. Don't exit arg loop early. Abort on bad arg number.
Diffstat (limited to 'opcodes')
| -rw-r--r-- | opcodes/ChangeLog | 7 | ||||
| -rw-r--r-- | opcodes/ns32k-dis.c | 19 |
2 files changed, 17 insertions, 9 deletions
diff --git a/opcodes/ChangeLog b/opcodes/ChangeLog index 7ca7a64..06b81d7 100644 --- a/opcodes/ChangeLog +++ b/opcodes/ChangeLog @@ -1,5 +1,12 @@ 2020-03-22 Alan Modra <amodra@gmail.com> + * ns32k-dis.c (print_insn_arg): Update comment. + (print_insn_ns32k): Reduce size of index_offset array, and + initialize, passing -1 to print_insn_arg for args that are not + an index. Don't exit arg loop early. Abort on bad arg number. + +2020-03-22 Alan Modra <amodra@gmail.com> + * s12z-dis.c (abstract_read_memory): Don't print error on EOI. * s12z-opc.c: Formatting. (operands_f): Return an int. diff --git a/opcodes/ns32k-dis.c b/opcodes/ns32k-dis.c index d505edd..12df182 100644 --- a/opcodes/ns32k-dis.c +++ b/opcodes/ns32k-dis.c @@ -446,7 +446,7 @@ invalid_float (float_type_u *p, int len) bit position of the addressing extension. BUFFER contains the instruction. ADDR is where BUFFER was read from. Put the disassembled version of the operand in RESULT. INDEX_OFFSET is the bit position - of the index byte (it contains garbage if this operand is not a + of the index byte (it contains -1 if this operand is not a general operand using scaled indexed addressing mode). */ static int @@ -790,10 +790,8 @@ print_insn_ns32k (bfd_vma memaddr, disassemble_info *info) if (*d) { /* Offset in bits of the first thing beyond each index byte. - Element 0 is for operand A and element 1 is for operand B. - The rest are irrelevant, but we put them here so we don't - index outside the array. */ - int index_offset[MAX_ARGS]; + Element 0 is for operand A and element 1 is for operand B. */ + int index_offset[2]; /* 0 for operand A, 1 for operand B, greater for other args. */ int whicharg = 0; @@ -806,6 +804,8 @@ print_insn_ns32k (bfd_vma memaddr, disassemble_info *info) if we are using scaled indexed addressing mode, since the index bytes occur right after the basic instruction, not as part of the addressing extension. */ + index_offset[0] = -1; + index_offset[1] = -1; if (Is_gen (d[1])) { int bitoff = d[1] == 'f' ? 10 : 5; @@ -832,15 +832,16 @@ print_insn_ns32k (bfd_vma memaddr, disassemble_info *info) while (*d) { argnum = *d - '1'; + if (argnum >= MAX_ARGS) + abort (); d++; - if (argnum > maxarg && argnum < MAX_ARGS) + if (argnum > maxarg) maxarg = argnum; ioffset = print_insn_arg (*d, ioffset, &aoffset, buffer, memaddr, arg_bufs[argnum], - index_offset[whicharg]); + whicharg > 1 ? -1 : index_offset[whicharg]); d++; - if (whicharg++ >= 1) - break; + whicharg++; } for (argnum = 0; argnum <= maxarg; argnum++) |