PR26510 UBSAN: tc-z8k.c left shift of negative value

This also fixes the packing of the nibble buffer, which contains
rubbish in the top 4 bits of each element.

	PR 26510
	* config/tc-z8k.c (buffer): Use unsigned char.
	(apply_fix): Use unsigned char* pointers.
	(build_bytes): Likewise and mask nibbles when packing.

diff --git a/gas/ChangeLog b/gas/ChangeLog
index 8642101aea9cdafc8cca7701aaa2ee424c07371d..80df2b32ca412bf8e287614374d84d755bb350e2 100644 (file)
--- a/gas/ChangeLog
+++ b/gas/ChangeLog
@@ -1,3 +1,10 @@
+2020-08-31  Alan Modra  <amodra@gmail.com>
+
+       PR 26510
+       * config/tc-z8k.c (buffer): Use unsigned char.
+       (apply_fix): Use unsigned char* pointers.
+       (build_bytes): Likewise and mask nibbles when packing.
+
 2020-08-31  Alan Modra  <amodra@gmail.com>
 
        PR 26503

diff --git a/gas/config/tc-z8k.c b/gas/config/tc-z8k.c
index 60e1d05cdbfdcad961815e37873081eb1f319244..58a69f63e5b718a40e27203bfc964fcd59802f13 100644 (file)
--- a/gas/config/tc-z8k.c
+++ b/gas/config/tc-z8k.c
@@ -953,7 +953,7 @@ get_specific (opcode_entry_type *opcode, op_type *operands)
     return 0;
 }
 
-static char buffer[20];
+static unsigned char buffer[20];
 
 static void
 newfix (int ptr, bfd_reloc_code_real_type type, int size, expressionS *operand)
@@ -984,9 +984,9 @@ newfix (int ptr, bfd_reloc_code_real_type type, int size, expressionS *operand)
     }
 }
 
-static char *
-apply_fix (char *ptr, bfd_reloc_code_real_type type, expressionS *operand,
-          int size)
+static unsigned char *
+apply_fix (unsigned char *ptr, bfd_reloc_code_real_type type,
+          expressionS *operand, int size)
 {
   long n = operand->X_add_number;
 
@@ -1020,7 +1020,7 @@ apply_fix (char *ptr, bfd_reloc_code_real_type type, expressionS *operand,
 static void
 build_bytes (opcode_entry_type *this_try, struct z8k_op *operand ATTRIBUTE_UNUSED)
 {
-  char *output_ptr = buffer;
+  unsigned char *output_ptr = buffer;
   int c;
   int nibble;
   unsigned int *class_ptr;
@@ -1183,12 +1183,12 @@ build_bytes (opcode_entry_type *this_try, struct z8k_op *operand ATTRIBUTE_UNUSE
   /* Copy from the nibble buffer into the frag.  */
   {
     int length = (output_ptr - buffer) / 2;
-    char *src = buffer;
-    char *fragp = frag_more (length);
+    unsigned char *src = buffer;
+    unsigned char *fragp = (unsigned char *) frag_more (length);
 
     while (src < output_ptr)
       {
-       *fragp = (src[0] << 4) | src[1];
+       *fragp = ((src[0] & 0xf) << 4) | (src[1] & 0xf);
        src += 2;
        fragp++;
       }