mirror of
https://git.yoctoproject.org/poky
synced 2026-04-01 23:02:21 +02:00
d2b21b2a14
Source: binutils-gdb.git
MR: 73997
Type: Security Fix
Disposition: Backport from binutils-2_29
ChangeID: 36893e1db9214b4da972a1eeb482be34405f0410
Description:
Fix address violation problems when disassembling a corrupt RX binary.
PR binutils/21587
* rx-decode.opc: Include libiberty.h
(GET_SCALE): New macro - validates access to SCALE array.
(GET_PSCALE): New macro - validates access to PSCALE array.
(DIs, SIs, S2Is, rx_disp): Use new macros.
* rx-decode.c: Regenerate.
Affects: <= 2.28
Author: Nick Clifton <nickc@redhat.com>
(From OE-Core rev: d8996fd2bf72fa774202724864ef014592a16ece)
Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com>
Reviewed-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
263 lines
8.5 KiB
Diff
263 lines
8.5 KiB
Diff
commit db5fa770268baf8cc82cf9b141d69799fd485fe2
|
|
Author: Nick Clifton <nickc@redhat.com>
|
|
Date: Wed Jun 14 13:35:06 2017 +0100
|
|
|
|
Fix address violation problems when disassembling a corrupt RX binary.
|
|
|
|
PR binutils/21587
|
|
* rx-decode.opc: Include libiberty.h
|
|
(GET_SCALE): New macro - validates access to SCALE array.
|
|
(GET_PSCALE): New macro - validates access to PSCALE array.
|
|
(DIs, SIs, S2Is, rx_disp): Use new macros.
|
|
* rx-decode.c: Regenerate.
|
|
|
|
Upstream-Status: Backport
|
|
|
|
CVE: CVE-2017-9750
|
|
Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com>
|
|
|
|
Index: git/opcodes/rx-decode.c
|
|
===================================================================
|
|
--- git.orig/opcodes/rx-decode.c 2017-09-21 14:41:57.478649861 +0530
|
|
+++ git/opcodes/rx-decode.c 2017-09-21 14:41:57.458649736 +0530
|
|
@@ -27,6 +27,7 @@
|
|
#include <string.h>
|
|
#include "ansidecl.h"
|
|
#include "opcode/rx.h"
|
|
+#include "libiberty.h"
|
|
|
|
#define RX_OPCODE_BIG_ENDIAN 0
|
|
|
|
@@ -45,7 +46,7 @@
|
|
#define LSIZE 2
|
|
|
|
/* These are for when the upper bits are "don't care" or "undefined". */
|
|
-static int bwl[] =
|
|
+static int bwl[4] =
|
|
{
|
|
RX_Byte,
|
|
RX_Word,
|
|
@@ -53,7 +54,7 @@
|
|
RX_Bad_Size /* Bogus instructions can have a size field set to 3. */
|
|
};
|
|
|
|
-static int sbwl[] =
|
|
+static int sbwl[4] =
|
|
{
|
|
RX_SByte,
|
|
RX_SWord,
|
|
@@ -61,7 +62,7 @@
|
|
RX_Bad_Size /* Bogus instructions can have a size field set to 3. */
|
|
};
|
|
|
|
-static int ubw[] =
|
|
+static int ubw[4] =
|
|
{
|
|
RX_UByte,
|
|
RX_UWord,
|
|
@@ -69,7 +70,7 @@
|
|
RX_Bad_Size /* Bogus instructions can have a size field set to 3. */
|
|
};
|
|
|
|
-static int memex[] =
|
|
+static int memex[4] =
|
|
{
|
|
RX_SByte,
|
|
RX_SWord,
|
|
@@ -89,6 +90,9 @@
|
|
/* This is for the prefix size enum. */
|
|
static int PSCALE[] = { 4, 1, 1, 1, 2, 2, 2, 3, 4 };
|
|
|
|
+#define GET_SCALE(_indx) ((unsigned)(_indx) < ARRAY_SIZE (SCALE) ? SCALE[(_indx)] : 0)
|
|
+#define GET_PSCALE(_indx) ((unsigned)(_indx) < ARRAY_SIZE (PSCALE) ? PSCALE[(_indx)] : 0)
|
|
+
|
|
static int flagmap[] = {0, 1, 2, 3, 0, 0, 0, 0,
|
|
16, 17, 0, 0, 0, 0, 0, 0 };
|
|
|
|
@@ -107,7 +111,7 @@
|
|
#define DC(c) OP (0, RX_Operand_Immediate, 0, c)
|
|
#define DR(r) OP (0, RX_Operand_Register, r, 0)
|
|
#define DI(r,a) OP (0, RX_Operand_Indirect, r, a)
|
|
-#define DIs(r,a,s) OP (0, RX_Operand_Indirect, r, (a) * SCALE[s])
|
|
+#define DIs(r,a,s) OP (0, RX_Operand_Indirect, r, (a) * GET_SCALE (s))
|
|
#define DD(t,r,s) rx_disp (0, t, r, bwl[s], ld);
|
|
#define DF(r) OP (0, RX_Operand_Flag, flagmap[r], 0)
|
|
|
|
@@ -115,7 +119,7 @@
|
|
#define SR(r) OP (1, RX_Operand_Register, r, 0)
|
|
#define SRR(r) OP (1, RX_Operand_TwoReg, r, 0)
|
|
#define SI(r,a) OP (1, RX_Operand_Indirect, r, a)
|
|
-#define SIs(r,a,s) OP (1, RX_Operand_Indirect, r, (a) * SCALE[s])
|
|
+#define SIs(r,a,s) OP (1, RX_Operand_Indirect, r, (a) * GET_SCALE (s))
|
|
#define SD(t,r,s) rx_disp (1, t, r, bwl[s], ld);
|
|
#define SP(t,r) rx_disp (1, t, r, (t!=3) ? RX_UByte : RX_Long, ld); P(t, 1);
|
|
#define SPm(t,r,m) rx_disp (1, t, r, memex[m], ld); rx->op[1].size = memex[m];
|
|
@@ -124,7 +128,7 @@
|
|
#define S2C(i) OP (2, RX_Operand_Immediate, 0, i)
|
|
#define S2R(r) OP (2, RX_Operand_Register, r, 0)
|
|
#define S2I(r,a) OP (2, RX_Operand_Indirect, r, a)
|
|
-#define S2Is(r,a,s) OP (2, RX_Operand_Indirect, r, (a) * SCALE[s])
|
|
+#define S2Is(r,a,s) OP (2, RX_Operand_Indirect, r, (a) * GET_SCALE (s))
|
|
#define S2D(t,r,s) rx_disp (2, t, r, bwl[s], ld);
|
|
#define S2P(t,r) rx_disp (2, t, r, (t!=3) ? RX_UByte : RX_Long, ld); P(t, 2);
|
|
#define S2Pm(t,r,m) rx_disp (2, t, r, memex[m], ld); rx->op[2].size = memex[m];
|
|
@@ -211,7 +215,7 @@
|
|
}
|
|
|
|
static void
|
|
-rx_disp (int n, int type, int reg, int size, LocalData * ld)
|
|
+rx_disp (int n, int type, int reg, unsigned int size, LocalData * ld)
|
|
{
|
|
int disp;
|
|
|
|
@@ -228,7 +232,7 @@
|
|
case 1:
|
|
ld->rx->op[n].type = RX_Operand_Indirect;
|
|
disp = GETBYTE ();
|
|
- ld->rx->op[n].addend = disp * PSCALE[size];
|
|
+ ld->rx->op[n].addend = disp * GET_PSCALE (size);
|
|
break;
|
|
case 2:
|
|
ld->rx->op[n].type = RX_Operand_Indirect;
|
|
@@ -238,7 +242,7 @@
|
|
#else
|
|
disp = disp + GETBYTE () * 256;
|
|
#endif
|
|
- ld->rx->op[n].addend = disp * PSCALE[size];
|
|
+ ld->rx->op[n].addend = disp * GET_PSCALE (size);
|
|
break;
|
|
default:
|
|
abort ();
|
|
Index: git/opcodes/rx-decode.opc
|
|
===================================================================
|
|
--- git.orig/opcodes/rx-decode.opc 2017-09-21 14:41:57.478649861 +0530
|
|
+++ git/opcodes/rx-decode.opc 2017-09-21 14:41:57.458649736 +0530
|
|
@@ -26,6 +26,7 @@
|
|
#include <string.h>
|
|
#include "ansidecl.h"
|
|
#include "opcode/rx.h"
|
|
+#include "libiberty.h"
|
|
|
|
#define RX_OPCODE_BIG_ENDIAN 0
|
|
|
|
@@ -44,7 +45,7 @@
|
|
#define LSIZE 2
|
|
|
|
/* These are for when the upper bits are "don't care" or "undefined". */
|
|
-static int bwl[] =
|
|
+static int bwl[4] =
|
|
{
|
|
RX_Byte,
|
|
RX_Word,
|
|
@@ -52,7 +53,7 @@
|
|
RX_Bad_Size /* Bogus instructions can have a size field set to 3. */
|
|
};
|
|
|
|
-static int sbwl[] =
|
|
+static int sbwl[4] =
|
|
{
|
|
RX_SByte,
|
|
RX_SWord,
|
|
@@ -60,7 +61,7 @@
|
|
RX_Bad_Size /* Bogus instructions can have a size field set to 3. */
|
|
};
|
|
|
|
-static int ubw[] =
|
|
+static int ubw[4] =
|
|
{
|
|
RX_UByte,
|
|
RX_UWord,
|
|
@@ -68,7 +69,7 @@
|
|
RX_Bad_Size /* Bogus instructions can have a size field set to 3. */
|
|
};
|
|
|
|
-static int memex[] =
|
|
+static int memex[4] =
|
|
{
|
|
RX_SByte,
|
|
RX_SWord,
|
|
@@ -88,6 +89,9 @@
|
|
/* This is for the prefix size enum. */
|
|
static int PSCALE[] = { 4, 1, 1, 1, 2, 2, 2, 3, 4 };
|
|
|
|
+#define GET_SCALE(_indx) ((unsigned)(_indx) < ARRAY_SIZE (SCALE) ? SCALE[(_indx)] : 0)
|
|
+#define GET_PSCALE(_indx) ((unsigned)(_indx) < ARRAY_SIZE (PSCALE) ? PSCALE[(_indx)] : 0)
|
|
+
|
|
static int flagmap[] = {0, 1, 2, 3, 0, 0, 0, 0,
|
|
16, 17, 0, 0, 0, 0, 0, 0 };
|
|
|
|
@@ -106,7 +110,7 @@
|
|
#define DC(c) OP (0, RX_Operand_Immediate, 0, c)
|
|
#define DR(r) OP (0, RX_Operand_Register, r, 0)
|
|
#define DI(r,a) OP (0, RX_Operand_Indirect, r, a)
|
|
-#define DIs(r,a,s) OP (0, RX_Operand_Indirect, r, (a) * SCALE[s])
|
|
+#define DIs(r,a,s) OP (0, RX_Operand_Indirect, r, (a) * GET_SCALE (s))
|
|
#define DD(t,r,s) rx_disp (0, t, r, bwl[s], ld);
|
|
#define DF(r) OP (0, RX_Operand_Flag, flagmap[r], 0)
|
|
|
|
@@ -114,7 +118,7 @@
|
|
#define SR(r) OP (1, RX_Operand_Register, r, 0)
|
|
#define SRR(r) OP (1, RX_Operand_TwoReg, r, 0)
|
|
#define SI(r,a) OP (1, RX_Operand_Indirect, r, a)
|
|
-#define SIs(r,a,s) OP (1, RX_Operand_Indirect, r, (a) * SCALE[s])
|
|
+#define SIs(r,a,s) OP (1, RX_Operand_Indirect, r, (a) * GET_SCALE (s))
|
|
#define SD(t,r,s) rx_disp (1, t, r, bwl[s], ld);
|
|
#define SP(t,r) rx_disp (1, t, r, (t!=3) ? RX_UByte : RX_Long, ld); P(t, 1);
|
|
#define SPm(t,r,m) rx_disp (1, t, r, memex[m], ld); rx->op[1].size = memex[m];
|
|
@@ -123,7 +127,7 @@
|
|
#define S2C(i) OP (2, RX_Operand_Immediate, 0, i)
|
|
#define S2R(r) OP (2, RX_Operand_Register, r, 0)
|
|
#define S2I(r,a) OP (2, RX_Operand_Indirect, r, a)
|
|
-#define S2Is(r,a,s) OP (2, RX_Operand_Indirect, r, (a) * SCALE[s])
|
|
+#define S2Is(r,a,s) OP (2, RX_Operand_Indirect, r, (a) * GET_SCALE (s))
|
|
#define S2D(t,r,s) rx_disp (2, t, r, bwl[s], ld);
|
|
#define S2P(t,r) rx_disp (2, t, r, (t!=3) ? RX_UByte : RX_Long, ld); P(t, 2);
|
|
#define S2Pm(t,r,m) rx_disp (2, t, r, memex[m], ld); rx->op[2].size = memex[m];
|
|
@@ -210,7 +214,7 @@
|
|
}
|
|
|
|
static void
|
|
-rx_disp (int n, int type, int reg, int size, LocalData * ld)
|
|
+rx_disp (int n, int type, int reg, unsigned int size, LocalData * ld)
|
|
{
|
|
int disp;
|
|
|
|
@@ -227,7 +231,7 @@
|
|
case 1:
|
|
ld->rx->op[n].type = RX_Operand_Indirect;
|
|
disp = GETBYTE ();
|
|
- ld->rx->op[n].addend = disp * PSCALE[size];
|
|
+ ld->rx->op[n].addend = disp * GET_PSCALE (size);
|
|
break;
|
|
case 2:
|
|
ld->rx->op[n].type = RX_Operand_Indirect;
|
|
@@ -237,7 +241,7 @@
|
|
#else
|
|
disp = disp + GETBYTE () * 256;
|
|
#endif
|
|
- ld->rx->op[n].addend = disp * PSCALE[size];
|
|
+ ld->rx->op[n].addend = disp * GET_PSCALE (size);
|
|
break;
|
|
default:
|
|
abort ();
|
|
Index: git/opcodes/ChangeLog
|
|
===================================================================
|
|
--- git.orig/opcodes/ChangeLog 2017-09-21 14:40:17.000000000 +0530
|
|
+++ git/opcodes/ChangeLog 2017-09-21 14:44:07.503461009 +0530
|
|
@@ -15,6 +15,15 @@
|
|
array.
|
|
* rl78-decode.c: Regenerate.
|
|
|
|
+2017-06-14 Nick Clifton <nickc@redhat.com>
|
|
+
|
|
+ PR binutils/21587
|
|
+ * rx-decode.opc: Include libiberty.h
|
|
+ (GET_SCALE): New macro - validates access to SCALE array.
|
|
+ (GET_PSCALE): New macro - validates access to PSCALE array.
|
|
+ (DIs, SIs, S2Is, rx_disp): Use new macros.
|
|
+ * rx-decode.c: Regenerate.
|
|
+
|
|
2016-08-03 Tristan Gingold <gingold@adacore.com>
|
|
|
|
* configure: Regenerate.
|