Bug 20699 - [libopcodes][x86] Decodes invalid 32-bit address for a 64-bit MPX instruction
Summary: [libopcodes][x86] Decodes invalid 32-bit address for a 64-bit MPX instruction
Status: RESOLVED FIXED
Alias: None
Product: binutils
Classification: Unclassified
Component: binutils (show other bugs)
Version: 2.26
: P2 normal
Target Milestone: 2.28
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-10-17 16:53 UTC by nholcomb
Modified: 2016-10-18 16:14 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:
Project(s) to access:
ssh public key:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description nholcomb 2016-10-17 16:53:44 UTC
Libopcodes produces invalid 32-bit address for a 64-bit MPX instruction.

Output: addr32 bndstx %bnd0, -0x76a5963e(%eip) # 0xffffffff895a69cb
Bytes: 67 41 0f 1b 05 c2 69 5a 89

This instruction should be shown as invalid because 64-bit MPX instructions cannot act on 32-bit addresses.
Comment 1 Sourceware Commits 2016-10-18 16:10:10 UTC
The master branch has been updated by H.J. Lu <hjl@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=285963233bc7509edb07c035426ee0096650b0af

commit 285963233bc7509edb07c035426ee0096650b0af
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Tue Oct 18 09:06:27 2016 -0700

    Check addr32flag instead of sizeflag for rip/eip
    
    Since the address size prefix, 0x67, is ignored for MPX instructions in
    64-bit mode, we should check addr32flag instead of sizeflag for rip/eip.
    
    	PR binutis/20699
    	* i386-dis.c (OP_E_memory): Check addr32flag instead of sizeflag
    	for rip/eip.
Comment 2 H.J. Lu 2016-10-18 16:14:18 UTC
(In reply to nholcomb from comment #0)
> Libopcodes produces invalid 32-bit address for a 64-bit MPX instruction.
> 
> Output: addr32 bndstx %bnd0, -0x76a5963e(%eip) # 0xffffffff895a69cb
> Bytes: 67 41 0f 1b 05 c2 69 5a 89
> 
> This instruction should be shown as invalid because 64-bit MPX instructions
> cannot act on 32-bit addresses.

Since the addr32 prefix is ignored in 64-bit mode, I checked in a patch to
display

67 41 0f 1b 05 c2 69 5a 89 	addr32 bndstx %bnd0,-0x76a5963e(%rip)