[binutils-gdb] x86: Check for more than 2 memory references

[H.J.Lu]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=1286ab788188bb8f0b0da2a3def4641fb3817f10

commit 1286ab788188bb8f0b0da2a3def4641fb3817f10
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Fri Jul 27 06:35:09 2018 -0700

    x86: Check for more than 2 memory references
    
    For
    
    movsd (%esi), %ss:(%edi), %ss:(%eax)
    
    we got
    
    [hjl@gnu-tools-1 tmp]$ as -o x.o x.s
    x.s: Assembler messages:
    x.s:1: Error: too many memory references for `movsd'
    munmap_chunk(): invalid pointer
    x.s:1: Internal error (Aborted).
    Please report this bug.
    [hjl@gnu-tools-1 tmp]$
    
    struct _i386_insn has
    
    const seg_entry *seg[2];
    
    3 memory references will overflow the seg array.  We should issue an
    error if there are more than 2 memory references.
    
    	PR gas/23453
    	* config/tc-i386.c (parse_operands): Check for more than 2
    	memory references.
    	* testsuite/gas/i386/inval.s: Add a movsd test with 3 memory
    	references.
    	* testsuite/gas/i386/x86-64-inval.s: Likewise.
    	* testsuite/gas/i386/inval.l: Updated.
    	* testsuite/gas/i386/x86-64-inval.l: Likewise.

Diff:
---
 gas/ChangeLog                         | 11 +++++++++++
 gas/config/tc-i386.c                  |  7 +++++++
 gas/testsuite/gas/i386/inval.l        |  4 ++++
 gas/testsuite/gas/i386/inval.s        |  3 +++
 gas/testsuite/gas/i386/x86-64-inval.l |  4 ++++
 gas/testsuite/gas/i386/x86-64-inval.s |  3 +++
 6 files changed, 32 insertions(+)

diff --git a/gas/ChangeLog b/gas/ChangeLog
index e8c500a..0cc4e55 100644
--- a/gas/ChangeLog
+++ b/gas/ChangeLog
@@ -1,5 +1,16 @@
 2018-07-26  H.J. Lu  <hongjiu.lu@intel.com>
 
+	PR gas/23453
+	* config/tc-i386.c (parse_operands): Check for more than 2
+	memory references.
+	* testsuite/gas/i386/inval.s: Add a movsd test with 3 memory
+	references.
+	* testsuite/gas/i386/x86-64-inval.s: Likewise.
+	* testsuite/gas/i386/inval.l: Updated.
+	* testsuite/gas/i386/x86-64-inval.l: Likewise.
+
+2018-07-26  H.J. Lu  <hongjiu.lu@intel.com>
+
 	* config/tc-i386.c (check_VecOperations): Initialize
 	broadcast_op.bytes to 0.
 
diff --git a/gas/config/tc-i386.c b/gas/config/tc-i386.c
index 9e9c676..cc01a58 100644
--- a/gas/config/tc-i386.c
+++ b/gas/config/tc-i386.c
@@ -4675,6 +4675,13 @@ parse_operands (char *l, const char *mnemonic)
 	  /* Now parse operand adding info to 'i' as we go along.  */
 	  END_STRING_AND_SAVE (l);
 
+	  if (i.mem_operands > 1)
+	    {
+	      as_bad (_("too many memory references for `%s'"),
+		      mnemonic);
+	      return 0;
+	    }
+
 	  if (intel_syntax)
 	    operand_ok =
 	      i386_intel_operand (token_start,
diff --git a/gas/testsuite/gas/i386/inval.l b/gas/testsuite/gas/i386/inval.l
index d5d8500..3d52a17 100644
--- a/gas/testsuite/gas/i386/inval.l
+++ b/gas/testsuite/gas/i386/inval.l
@@ -87,6 +87,7 @@
 .*:97: Error: .*shl.*
 .*:98: Error: .*rol.*
 .*:99: Error: .*rcl.*
+.*:102: Error: .*
 GAS LISTING .*
 
 
@@ -192,3 +193,6 @@ GAS LISTING .*
 [ 	]*[1-9][0-9]*[ 	]+shl \[eax\], 1
 [ 	]*[1-9][0-9]*[ 	]+rol \[ecx\], 2
 [ 	]*[1-9][0-9]*[ 	]+rcl \[edx\], cl
+[ 	]*[1-9][0-9]*[ 	]+
+[ 	]*[1-9][0-9]*[ 	]+\.att_syntax prefix
+[ 	]*[1-9][0-9]*[ 	]+movsd \(%esi\), %ss:\(%edi\), %ss:\(%eax\)
diff --git a/gas/testsuite/gas/i386/inval.s b/gas/testsuite/gas/i386/inval.s
index dbf8b96..47655e5 100644
--- a/gas/testsuite/gas/i386/inval.s
+++ b/gas/testsuite/gas/i386/inval.s
@@ -97,3 +97,6 @@ movnti word ptr [eax], ax
 	shl [eax], 1
 	rol [ecx], 2
 	rcl [edx], cl
+
+	.att_syntax prefix
+	movsd (%esi), %ss:(%edi), %ss:(%eax)
diff --git a/gas/testsuite/gas/i386/x86-64-inval.l b/gas/testsuite/gas/i386/x86-64-inval.l
index 099cc62..bbb8ba2 100644
--- a/gas/testsuite/gas/i386/x86-64-inval.l
+++ b/gas/testsuite/gas/i386/x86-64-inval.l
@@ -110,6 +110,7 @@
 .*:116: Error: .*
 .*:117: Error: .*
 .*:118: Error: .*
+.*:121: Error: .*
 GAS LISTING .*
 
 
@@ -237,3 +238,6 @@ GAS LISTING .*
 [ 	]*116[ 	]+jmpd \[rax\]	\# 32-bit data size not allowed
 [ 	]*117[ 	]+jmpq \[ax\]	\# no 16-bit addressing
 [ 	]*[1-9][0-9]*[ 	]+mov eax,\[rax\+0x876543210\] \# out of range displacement
+[ 	]*[1-9][0-9]*[ 	]+
+[ 	]*[1-9][0-9]*[ 	]+\.att_syntax prefix
+[ 	]*[1-9][0-9]*[ 	]+movsd \(%rsi\), %ss:\(%rdi\), %ss:\(%rax\)
diff --git a/gas/testsuite/gas/i386/x86-64-inval.s b/gas/testsuite/gas/i386/x86-64-inval.s
index 1ce8320..85c3582 100644
--- a/gas/testsuite/gas/i386/x86-64-inval.s
+++ b/gas/testsuite/gas/i386/x86-64-inval.s
@@ -116,3 +116,6 @@ movnti word ptr [rax], ax
 	jmpd [rax]	# 32-bit data size not allowed
 	jmpq [ax]	# no 16-bit addressing
 	mov eax,[rax+0x876543210] # out of range displacement
+
+	.att_syntax prefix
+	movsd (%rsi), %ss:(%rdi), %ss:(%rax)