| From 08c7881b814c546efc3996fd1decdf0877f7a779 Mon Sep 17 00:00:00 2001 |
| From: Nick Clifton <nickc@redhat.com> |
| Date: Thu, 15 Jun 2017 11:52:02 +0100 |
| Subject: [PATCH] Prevent invalid array accesses when disassembling a corrupt |
| bfin binary. |
| |
| PR binutils/21586 |
| * bfin-dis.c (gregs): Clip index to prevent overflow. |
| (regs): Likewise. |
| (regs_lo): Likewise. |
| (regs_hi): Likewise. |
| |
| Upstream-Status: Backport |
| CVE: CVE-2017-9749 |
| Signed-off-by: Armin Kuster <akuster@mvista.com> |
| |
| --- |
| opcodes/ChangeLog | 8 ++++++++ |
| opcodes/bfin-dis.c | 8 ++++---- |
| 2 files changed, 12 insertions(+), 4 deletions(-) |
| |
| Index: git/opcodes/ChangeLog |
| =================================================================== |
| --- git.orig/opcodes/ChangeLog |
| +++ git/opcodes/ChangeLog |
| @@ -1,3 +1,11 @@ |
| +2017-06-15 Nick Clifton <nickc@redhat.com> |
| + |
| + PR binutils/21586 |
| + * bfin-dis.c (gregs): Clip index to prevent overflow. |
| + (regs): Likewise. |
| + (regs_lo): Likewise. |
| + (regs_hi): Likewise. |
| + |
| 2017-06-14 Nick Clifton <nickc@redhat.com> |
| |
| PR binutils/21576 |
| Index: git/opcodes/bfin-dis.c |
| =================================================================== |
| --- git.orig/opcodes/bfin-dis.c |
| +++ git/opcodes/bfin-dis.c |
| @@ -350,7 +350,7 @@ static const enum machine_registers deco |
| REG_P0, REG_P1, REG_P2, REG_P3, REG_P4, REG_P5, REG_SP, REG_FP, |
| }; |
| |
| -#define gregs(x, i) REGNAME (decode_gregs[((i) << 3) | (x)]) |
| +#define gregs(x, i) REGNAME (decode_gregs[(((i) << 3) | (x)) & 15]) |
| |
| /* [dregs pregs (iregs mregs) (bregs lregs)]. */ |
| static const enum machine_registers decode_regs[] = |
| @@ -361,7 +361,7 @@ static const enum machine_registers deco |
| REG_B0, REG_B1, REG_B2, REG_B3, REG_L0, REG_L1, REG_L2, REG_L3, |
| }; |
| |
| -#define regs(x, i) REGNAME (decode_regs[((i) << 3) | (x)]) |
| +#define regs(x, i) REGNAME (decode_regs[(((i) << 3) | (x)) & 31]) |
| |
| /* [dregs pregs (iregs mregs) (bregs lregs) Low Half]. */ |
| static const enum machine_registers decode_regs_lo[] = |
| @@ -372,7 +372,7 @@ static const enum machine_registers deco |
| REG_BL0, REG_BL1, REG_BL2, REG_BL3, REG_LL0, REG_LL1, REG_LL2, REG_LL3, |
| }; |
| |
| -#define regs_lo(x, i) REGNAME (decode_regs_lo[((i) << 3) | (x)]) |
| +#define regs_lo(x, i) REGNAME (decode_regs_lo[(((i) << 3) | (x)) & 31]) |
| |
| /* [dregs pregs (iregs mregs) (bregs lregs) High Half]. */ |
| static const enum machine_registers decode_regs_hi[] = |
| @@ -383,7 +383,7 @@ static const enum machine_registers deco |
| REG_BH0, REG_BH1, REG_BH2, REG_BH3, REG_LH0, REG_LH1, REG_LH2, REG_LH3, |
| }; |
| |
| -#define regs_hi(x, i) REGNAME (decode_regs_hi[((i) << 3) | (x)]) |
| +#define regs_hi(x, i) REGNAME (decode_regs_hi[(((i) << 3) | (x)) & 31]) |
| |
| static const enum machine_registers decode_statbits[] = |
| { |