From 28cfe5dab0578f4b07d746d1c4dac5732ff50ea6 Mon Sep 17 00:00:00 2001 From: "Emilio G. Cota" Date: Fri, 11 May 2018 13:51:47 -0400 Subject: [PATCH] target/mips: avoid integer overflow in next_page PC check If the PC is in the last page of the address space, next_page_start overflows to 0. Fix it. Backports commit 6cd79443d33e6ba6b4c5b787eb713ca1cec56328 from qemu --- qemu/target/mips/translate.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/qemu/target/mips/translate.c b/qemu/target/mips/translate.c index 7d2c4311..9bbe4b6c 100644 --- a/qemu/target/mips/translate.c +++ b/qemu/target/mips/translate.c @@ -20373,7 +20373,7 @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb) CPUMIPSState *env = cs->env_ptr; DisasContext ctx; target_ulong pc_start; - target_ulong next_page_start; + target_ulong page_start; int num_insns; int max_insns; int insn_bytes; @@ -20384,7 +20384,7 @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb) bool block_full = false; pc_start = tb->pc; - next_page_start = (pc_start & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE; + page_start = pc_start & TARGET_PAGE_MASK; ctx.uc = env->uc; ctx.pc = pc_start; ctx.saved_pc = -1; @@ -20553,7 +20553,7 @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb) break; } - if (ctx.pc >= next_page_start) { + if (ctx.pc - page_start >= TARGET_PAGE_SIZE) { break; }