yuzu/unicorn
1
0
Fork 0
mirror of https://github.com/yuzu-emu/unicorn.git synced 2025-01-11 14:05:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

target-arm: check that LSB <= MSB in BFI instruction

Browse source 
The documentation states that if LSB > MSB in BFI instruction behaviour
is unpredictable. Currently QEMU crashes because of assertion failure in
this case:

tcg/tcg-op.h:2061: tcg_gen_deposit_i32: Assertion `len <= 32' failed.

While assertion failure may meet the "unpredictable" definition this
behaviour is undesirable because it allows an unprivileged guest program
to crash the emulator with the OS and other programs.

This patch addresses the issue by throwing illegal instruction exception
if LSB > MSB. Only ARM decoder is affected because Thumb decoder already
has this check in place.

To reproduce issue run the following program

int main(void) {
asm volatile (".long 0x07c00c12" :: );
return 0;
}

compiled with
gcc -marm -static badop_arm.c -o badop_arm

Backports commit 45140a57675ecb4b0daee71bf145c24dbdf9429c from qemu
This commit is contained in:
Kirill Batuzov 2018-02-12 11:05:37 -05:00 committed by Lioncash
parent 1c275134ae
commit d45ea1ba3b
No known key found for this signature in database
GPG key ID: 4E3C3CC1031BA9C7
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
qemu/target-arm/translate.c
View file

@ -8910,6 +8910,10 @@ static void disas_arm_insn(DisasContext *s, unsigned int insn) // qq
ARCH(6T2);
shift = (insn >> 7) & 0x1f;
i = (insn >> 16) & 0x1f;
if (i < shift) {
/* UNPREDICTABLE; we choose to UNDEF */
goto illegal_op;
}
i = i + 1 - shift;
if (rm == 15) {
tmp = tcg_temp_new_i32(tcg_ctx);