From 08c7881b814c546efc3996fd1decdf0877f7a779 Mon Sep 17 00:00:00 2001 From: Nick Clifton Date: Thu, 15 Jun 2017 11:52:02 +0100 Subject: [PATCH] Prevent invalid array accesses when disassembling a corrupt bfin binary. PR binutils/21586 * bfin-dis.c (gregs): Clip index to prevent overflow. (regs): Likewise. (regs_lo): Likewise. (regs_hi): Likewise. Upstream-Status: Backport CVE: CVE-2017-9749 Signed-off-by: Armin Kuster --- opcodes/ChangeLog | 8 ++++++++ opcodes/bfin-dis.c | 8 ++++---- 2 files changed, 12 insertions(+), 4 deletions(-) Index: git/opcodes/ChangeLog =================================================================== --- git.orig/opcodes/ChangeLog +++ git/opcodes/ChangeLog @@ -1,3 +1,11 @@ +2017-06-15 Nick Clifton + + PR binutils/21586 + * bfin-dis.c (gregs): Clip index to prevent overflow. + (regs): Likewise. + (regs_lo): Likewise. + (regs_hi): Likewise. + 2017-06-14 Nick Clifton PR binutils/21576 Index: git/opcodes/bfin-dis.c =================================================================== --- git.orig/opcodes/bfin-dis.c +++ git/opcodes/bfin-dis.c @@ -350,7 +350,7 @@ static const enum machine_registers deco REG_P0, REG_P1, REG_P2, REG_P3, REG_P4, REG_P5, REG_SP, REG_FP, }; -#define gregs(x, i) REGNAME (decode_gregs[((i) << 3) | (x)]) +#define gregs(x, i) REGNAME (decode_gregs[(((i) << 3) | (x)) & 15]) /* [dregs pregs (iregs mregs) (bregs lregs)]. */ static const enum machine_registers decode_regs[] = @@ -361,7 +361,7 @@ static const enum machine_registers deco REG_B0, REG_B1, REG_B2, REG_B3, REG_L0, REG_L1, REG_L2, REG_L3, }; -#define regs(x, i) REGNAME (decode_regs[((i) << 3) | (x)]) +#define regs(x, i) REGNAME (decode_regs[(((i) << 3) | (x)) & 31]) /* [dregs pregs (iregs mregs) (bregs lregs) Low Half]. */ static const enum machine_registers decode_regs_lo[] = @@ -372,7 +372,7 @@ static const enum machine_registers deco REG_BL0, REG_BL1, REG_BL2, REG_BL3, REG_LL0, REG_LL1, REG_LL2, REG_LL3, }; -#define regs_lo(x, i) REGNAME (decode_regs_lo[((i) << 3) | (x)]) +#define regs_lo(x, i) REGNAME (decode_regs_lo[(((i) << 3) | (x)) & 31]) /* [dregs pregs (iregs mregs) (bregs lregs) High Half]. */ static const enum machine_registers decode_regs_hi[] = @@ -383,7 +383,7 @@ static const enum machine_registers deco REG_BH0, REG_BH1, REG_BH2, REG_BH3, REG_LH0, REG_LH1, REG_LH2, REG_LH3, }; -#define regs_hi(x, i) REGNAME (decode_regs_hi[((i) << 3) | (x)]) +#define regs_hi(x, i) REGNAME (decode_regs_hi[(((i) << 3) | (x)) & 31]) static const enum machine_registers decode_statbits[] = {