system/qemu
system/qemu
1
0
Fork 0
mirror of https://gitlab.com/qemu-project/qemu synced 2024-10-15 15:32:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

target/tricore: Fix out-of-bounds index in imask instruction

Browse source 
When translating  "imask" instruction of Tricore architecture, QEMU did not check whether the register index was out of bounds, resulting in a global-buffer-overflow.

Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1698
Reported-by: Siqi Chen <coc.cyqh@gmail.com>
Signed-off-by: Siqi Chen <coc.cyqh@gmail.com>
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Message-Id: <20230612065633.149152-1-coc.cyqh@gmail.com>
Message-Id: <20230612113245.56667-2-kbastian@mail.uni-paderborn.de>
This commit is contained in:
Siqi Chen 2023-06-12 13:32:42 +02:00 committed by Bastian Koppelmann
parent 0b9f9b63c2
commit d34b092cab
1 changed files with 1 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
target/tricore/translate.c
View file

@ -5339,6 +5339,7 @@ static void decode_rcrw_insert(DisasContext *ctx)
switch (op2) {
case OPC2_32_RCRW_IMASK:
CHECK_REG_PAIR(r4);
tcg_gen_andi_tl(temp, cpu_gpr_d[r3], 0x1f);
tcg_gen_movi_tl(temp2, (1 << width) - 1);
tcg_gen_shl_tl(cpu_gpr_d[r4 + 1], temp2, temp);