[PATCH] x86: fix disassembler buffer overflow

[Jan Beulich]

This fixes the buffer overflow triggered by too long prefix streams. It
also
changes the instruction length limit to the architectural value of 15.

Built and tested on i686-pc-linux-gnu and x86_64-unknown-linux-gnu.

Jan

opcodes/
2005-12-08  Jan Beulich  <jbeulich@novell.com>

	* i386-dis.c (MAXLEN): Reduce to architectural limit.
	(fetch_data): Check for sufficient buffer size.

---
/home/jbeulich/src/binutils/mainline/2005-12-08/opcodes/i386-dis.c	2005-12-08
11:37:24.000000000 +0100
+++ 2005-12-08/opcodes/i386-dis.c	2005-12-08 11:28:46.000000000
+0100
@@ -35,7 +35,7 @@
 #include "sysdep.h"
 #include "opintl.h"
 
-#define MAXLEN 20
+#define MAXLEN 15
 
 #include <setjmp.h>
 
@@ -179,10 +179,13 @@ fetch_data (struct disassemble_info *inf
   struct dis_private *priv = (struct dis_private *)
info->private_data;
   bfd_vma start = priv->insn_start + (priv->max_fetched -
priv->the_buffer);
 
-  status = (*info->read_memory_func) (start,
-				      priv->max_fetched,
-				      addr - priv->max_fetched,
-				      info);
+  if (addr <= priv->the_buffer + MAXLEN)
+    status = (*info->read_memory_func) (start,
+					priv->max_fetched,
+					addr - priv->max_fetched,
+					info);
+  else
+    status = -1;
   if (status != 0)
     {
       /* If we did manage to read at least one byte, then

-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: binutils-mainline-x86-disasm-buffer.patch
URL: <https://sourceware.org/pipermail/binutils/attachments/20051208/43b2881c/attachment.ksh>