| Message ID | 1488556233-31246-6-git-send-email-peter.maydell@linaro.org |
|---|---|
| State | New |
| Headers | show |
On 03/03/2017 12:58 PM, Edgar E. Iglesias wrote: > On Fri, Mar 03, 2017 at 03:50:32PM +0000, Peter Maydell wrote: >> In the cris disassembler we were using 'unsigned long' to calculate >> addresses which are supposed to be 32 bits. This meant that we might >> accidentally sign extend or calculate a value that was outside the 32 >> bit range of the guest CPU. Use 'uint32_t' instead so we give the >> right answers on 64-bit hosts. >> >> (Spotted by Coverity, CID 1005402, 1005403.) > > Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> > Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> > >> >> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> >> --- >> disas/cris.c | 4 ++-- >> 1 file changed, 2 insertions(+), 2 deletions(-) >> >> diff --git a/disas/cris.c b/disas/cris.c >> index 8a1daf9..30217f1 100644 >> --- a/disas/cris.c >> +++ b/disas/cris.c >> @@ -2009,7 +2009,7 @@ print_with_operands (const struct cris_opcode *opcodep, >> case 'n': >> { >> /* Like N but pc-relative to the start of the insn. */ >> - unsigned long number >> + uint32_t number >> = (buffer[2] + buffer[3] * 256 + buffer[4] * 65536 >> + buffer[5] * 0x1000000 + addr); >> >> @@ -2201,7 +2201,7 @@ print_with_operands (const struct cris_opcode *opcodep, >> { >> /* It's [pc+]. This cannot possibly be anything >> but an address. */ >> - unsigned long number >> + uint32_t number >> = prefix_buffer[2] + prefix_buffer[3] * 256 >> + prefix_buffer[4] * 65536 >> + prefix_buffer[5] * 0x1000000; >> -- >> 2.7.4 >> >
diff --git a/disas/cris.c b/disas/cris.c index 8a1daf9..30217f1 100644 --- a/disas/cris.c +++ b/disas/cris.c @@ -2009,7 +2009,7 @@ print_with_operands (const struct cris_opcode *opcodep, case 'n': { /* Like N but pc-relative to the start of the insn. */ - unsigned long number + uint32_t number = (buffer[2] + buffer[3] * 256 + buffer[4] * 65536 + buffer[5] * 0x1000000 + addr); @@ -2201,7 +2201,7 @@ print_with_operands (const struct cris_opcode *opcodep, { /* It's [pc+]. This cannot possibly be anything but an address. */ - unsigned long number + uint32_t number = prefix_buffer[2] + prefix_buffer[3] * 256 + prefix_buffer[4] * 65536 + prefix_buffer[5] * 0x1000000;
In the cris disassembler we were using 'unsigned long' to calculate addresses which are supposed to be 32 bits. This meant that we might accidentally sign extend or calculate a value that was outside the 32 bit range of the guest CPU. Use 'uint32_t' instead so we give the right answers on 64-bit hosts. (Spotted by Coverity, CID 1005402, 1005403.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- disas/cris.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)