Virtualization
/
capstone
mirror of https://gitlab.com/qemu-project/capstone.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Fix OOB read and wries (#2273) 

* Fix OOB read due to wrong macro in use.

* Fix OOB write for regs_write and replace hardcoded values.
This commit is contained in:
Rot127 2024-02-18 05:03:05 +00:00 committed by GitHub
parent 336171c333
commit 34a1e012b7
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Mapping.c
View File

@ -95,7 +95,7 @@ void map_add_implicit_read(MCInst *MI, uint32_t Reg)
return;
uint16_t *regs_read = MI->flat_insn->detail->regs_read;
for (int i = 0; i < MAX_IMPL_W_REGS; ++i) {
for (int i = 0; i < MAX_IMPL_R_REGS; ++i) {
if (i == MI->flat_insn->detail->regs_read_count) {
regs_read[i] = Reg;
MI->flat_insn->detail->regs_read_count++;

6
arch/M68K/M68KDisassembler.h
View File

@ -17,11 +17,11 @@ typedef struct m68k_info {
unsigned int type;
unsigned int address_mask; /* Address mask to simulate address lines */
cs_m68k extension;
uint16_t regs_read[20]; // list of implicit registers read by this insn
uint16_t regs_read[MAX_IMPL_R_REGS]; // list of implicit registers read by this insn
uint8_t regs_read_count; // number of implicit registers read by this insn
uint16_t regs_write[20]; // list of implicit registers modified by this insn
uint16_t regs_write[MAX_IMPL_W_REGS]; // list of implicit registers modified by this insn
uint8_t regs_write_count; // number of implicit registers modified by this insn
uint8_t groups[8];
uint8_t groups[MAX_NUM_GROUPS];
uint8_t groups_count;
} m68k_info;

4
arch/M68K/M68KInstPrinter.c
View File

@ -276,10 +276,10 @@ void M68K_printInst(MCInst* MI, SStream* O, void* PrinterInfo)
memcpy(&detail->m68k, ext, sizeof(cs_m68k));
memcpy(&detail->regs_read, &info->regs_read, regs_read_count * sizeof(uint16_t));
memcpy(&detail->regs_read, &info->regs_read, regs_read_count * sizeof(info->regs_read[0]));
detail->regs_read_count = regs_read_count;
memcpy(&detail->regs_write, &info->regs_write, regs_write_count * sizeof(uint16_t));
memcpy(&detail->regs_write, &info->regs_write, regs_write_count * sizeof(info->regs_write[0]));
detail->regs_write_count = regs_write_count;
memcpy(&detail->groups, &info->groups, groups_count);