[PATCH] kvx: fix kvx_reassemble_bundle index 8 out of bounds

[Paul Iannetta]

On Thu, Aug 24, 2023 at 06:38:25PM +0930, Alan Modra wrote:
> On Thu, Aug 24, 2023 at 10:49:06AM +0200, Paul Iannetta wrote:
> > On Thu, Aug 24, 2023 at 12:42:33PM +0930, Alan Modra wrote:
> > > On Wed, Aug 23, 2023 at 04:39:19PM +0200, Paul Iannetta via Binutils wrote:
> > > > As discussed earlier, I removed kvx_elf64_linux_vec, fix the handling of unique
> > > > symbols by using has_gnu_osabi instead of overwriting e_ident, change (unsigned)
> > > > long long into {u,}int64 and at some place int by int32_t.
> > > 
> > > I've committed these for you.  BTW, oss-fuzz is poking at the kvx
> > > support and finding holes.  See pr30793.
> > 
> > The attached patch should fix pr30793.
> 
> decode_prologue_epilogue_bundle too?

Indeed, thanks. (Currently, this is deadcode, because it is only used
by gdb which we have not contribued back yet).

> 
> > 
> > Thanks,
> > Paul
> > 
> > 
> 
> > >From 03c35cf18fa689bc7d727c506d30c396244cb307 Mon Sep 17 00:00:00 2001
> > From: Paul Iannetta <piannetta@kalrayinc.com>
> > Date: Thu, 24 Aug 2023 10:39:14 +0200
> > Subject: [PATCH] kvx: fix kvx_reassemble_bundle index 8 out of bounds
> > 
> > opcodes/ChangeLog:
> > 
> > 2023-08-24  Paul Iannetta  <piannetta@kalrayinc.com>
> > 
> > 	* kvx-dis.c (print_insn_kvx): Change the loop condition so that
> > 	  wordcount is always less than KVXMAXBUNDLEWORDS.
> > ---
> >  opcodes/kvx-dis.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/opcodes/kvx-dis.c b/opcodes/kvx-dis.c
> > index e63430a9e57..a78eb5f84ec 100644
> > --- a/opcodes/kvx-dis.c
> > +++ b/opcodes/kvx-dis.c
> > @@ -1056,7 +1056,7 @@ print_insn_kvx (bfd_vma memaddr, struct disassemble_info *info)
> >  	  wordcount++;
> >  	}
> >        while (kvx_has_parallel_bit (bundle_words[wordcount - 1])
> > -	     && wordcount < KVXMAXBUNDLEWORDS);
> > +	     && wordcount < KVXMAXBUNDLEWORDS - 1);
> >        invalid_bundle = kvx_reassemble_bundle (wordcount, &insncount);
> >      }
> >  
> > -- 
> > 2.35.1.500.gb896f729e2
> > 
> 
> 
> -- 
> Alan Modra
> Australia Development Lab, IBM
> 
> 
> 
> 


-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-kvx-fix-kvx_reassemble_bundle-index-8-out-of-bounds.patch
Type: text/x-diff
Size: 1348 bytes
Desc: not available
URL: <https://sourceware.org/pipermail/binutils/attachments/20230824/7fefdf71/attachment.bin>