diff options
| author | Alan Modra <amodra@gmail.com> | 2019-12-19 15:38:39 +1030 |
|---|---|---|
| committer | Alan Modra <amodra@gmail.com> | 2019-12-19 15:38:39 +1030 |
| commit | f00901886d0acb7a4d4b177a5cabe8bd9ca2307b (patch) | |
| tree | 5ed06c27df45ecc145c0562a7373db42b251bca5 /opcodes/vax-dis.c | |
| parent | 9ad9b810c385c83242a3100fa986d174c83ffe10 (diff) | |
| download | gdb-f00901886d0acb7a4d4b177a5cabe8bd9ca2307b.zip gdb-f00901886d0acb7a4d4b177a5cabe8bd9ca2307b.tar.gz gdb-f00901886d0acb7a4d4b177a5cabe8bd9ca2307b.tar.bz2 | |
vax decoding of indexed addressing mode
This patch prevents print_insn_mode recursing into another index mode
byte, which if repeated enough times will overflow private.the_buffer
and scribble over other memory.
* vax-dis.c (print_insn_mode): Stop index mode recursion.
Diffstat (limited to 'opcodes/vax-dis.c')
| -rw-r--r-- | opcodes/vax-dis.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/opcodes/vax-dis.c b/opcodes/vax-dis.c index 0b33141..f880015 100644 --- a/opcodes/vax-dis.c +++ b/opcodes/vax-dis.c @@ -240,8 +240,18 @@ print_insn_mode (const char *d, (*info->fprintf_func) (info->stream, "$0x%x", mode); break; case 0x40: /* Index: base-addr[Rn] */ - p += print_insn_mode (d, size, p0 + 1, addr + 1, info); - (*info->fprintf_func) (info->stream, "[%s]", reg_names[reg]); + { + unsigned char *q = p0 + 1; + unsigned char nextmode = NEXTBYTE (q); + if (nextmode < 0x60 || nextmode == 0x8f) + /* Literal, index, register, or immediate is invalid. In + particular don't recurse into another index mode which + might overflow the_buffer. */ + (*info->fprintf_func) (info->stream, "[invalid base]"); + else + p += print_insn_mode (d, size, p0 + 1, addr + 1, info); + (*info->fprintf_func) (info->stream, "[%s]", reg_names[reg]); + } break; case 0x50: /* Register: Rn */ (*info->fprintf_func) (info->stream, "%s", reg_names[reg]); |