yuzu/unicorn
1
0
Fork 0
mirror of https://github.com/yuzu-emu/unicorn.git synced 2025-03-23 06:25:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

target/arm: avoid integer overflow in next_page PC check

Browse source 
If the PC is in the last page of the address space, next_page_start
overflows to 0. Fix it.

Backports commit bfe7ad5be77a6a8925a7ab1628452c8942222102 from qemu
This commit is contained in:
Emilio G. Cota 2018-05-11 13:47:17 -04:00 committed by Lioncash
parent f417df19b7
commit 8162e6f1c6
No known key found for this signature in database
GPG key ID: 4E3C3CC1031BA9C7
2 changed files with 6 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
qemu/target/arm/translate.c
View file

@ -10098,7 +10098,7 @@ static bool thumb_insn_is_16bit(DisasContext *s, uint32_t insn)
return false;
}
if ((insn >> 11) == 0x1e && (s->pc < s->next_page_start - 3)) {
if ((insn >> 11) == 0x1e && s->pc - s->page_start < TARGET_PAGE_SIZE - 3) {
/* 0b1111_0xxx_xxxx_xxxx : BL/BLX prefix, and the suffix
* is not on the next page; we merge this into a 32-bit
* insn.
@ -12500,8 +12500,7 @@ static int arm_tr_init_disas_context(DisasContextBase *dcbase,
dc->is_ldex = false;
dc->ss_same_el = false; /* Can't be true since EL_d must be AArch64 */
dc->next_page_start =
(dc->base.pc_first & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
dc->page_start = dc->base.pc_first & TARGET_PAGE_MASK;
/* If architectural single step active, limit to 1. */
if (is_singlestepping(dc)) {
@ -12511,7 +12510,7 @@ static int arm_tr_init_disas_context(DisasContextBase *dcbase,
/* ARM is a fixed-length ISA. Bound the number of insns to execute
to those left on the page. */
if (!dc->thumb) {
int bound = (dc->next_page_start - dc->base.pc_first) / 4;
int bound = -(dc->base.pc_first | TARGET_PAGE_MASK) / 4;
max_insns = MIN(max_insns, bound);
}
@ -12790,8 +12789,8 @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
* but isn't very efficient).
*/
if (dc->base.is_jmp == DISAS_NEXT
&& (dc->pc >= dc->next_page_start
|| (dc->pc >= dc->next_page_start - 3
&& (dc->pc - dc->page_start >= TARGET_PAGE_SIZE
|| (dc->pc - dc->page_start >= TARGET_PAGE_SIZE - 3
&& insn_crosses_page(env, dc)))) {
dc->base.is_jmp = DISAS_TOO_MANY;
}

2
qemu/target/arm/translate.h
View file

@ -8,7 +8,7 @@ typedef struct DisasContext {
DisasContextBase base;
target_ulong pc;
target_ulong next_page_start;
target_ulong page_start;
uint32_t insn;
/* Nonzero if this instruction has been conditionally skipped. */
int condjmp;