Fix an illegal memory access when disassembling a corrupt MeP file.

  PR 30231
  * mep.opc (mep_print_insn): Check for an out of range index.

diff --git a/cpu/ChangeLog b/cpu/ChangeLog
index bcb92e5cc5694996723644f2ba9339affc12f65e..23c89c99eabe4c852513ac3fff80cb70db71210b 100644 (file)
--- a/cpu/ChangeLog
+++ b/cpu/ChangeLog
@@ -1,3 +1,8 @@
+2023-03-15  Nick Clifton  <nickc@redhat.com>
+
+       PR 30231
+       * mep.opc (mep_print_insn): Check for an out of range index.
+
 2022-12-31  Nick Clifton  <nickc@redhat.com>
 
        * 2.40 branch created.

diff --git a/cpu/mep.opc b/cpu/mep.opc
index 75ae8308599a5372e7d513ca504cfc061932d569..6b264ccb73ecf35bcc2fe7cfcb2b234839bdc420 100644 (file)
--- a/cpu/mep.opc
+++ b/cpu/mep.opc
@@ -1453,6 +1453,20 @@ mep_print_insn (CGEN_CPU_DESC cd, bfd_vma pc, disassemble_info *info)
          mep_config_index = abfd->tdata.elf_obj_data->elf_header->e_flags & EF_MEP_INDEX_MASK;
          /* This instantly redefines MEP_CONFIG, MEP_OMASK, .... MEP_VLIW64 */
 
+         /* mep_config_map is a variable sized array, so we do not know how big it is.
+            The only safe way to check the index therefore is to iterate over the array.
+            We do know that the last entry is all null.  */
+         int i;
+         for (i = 0; i <= mep_config_index; i++)
+           if (mep_config_map[i].name == NULL)
+             break;
+         
+         if (i < mep_config_index)
+           {
+             opcodes_error_handler (_("illegal MEP INDEX setting '%x' in ELF header e_flags field"), mep_config_index);
+             mep_config_index = 0;
+           }
+         
          cop_type = abfd->tdata.elf_obj_data->elf_header->e_flags & EF_MEP_COP_MASK;
          if (cop_type == EF_MEP_COP_IVC2)
            ivc2 = 1;

diff --git a/opcodes/ChangeLog b/opcodes/ChangeLog
index fb6612abfa62bbd2277d10075fba61ad1a739380..e8a224bc424e7e5614ecd1b42bf96832e6c5722b 100644 (file)
--- a/opcodes/ChangeLog
+++ b/opcodes/ChangeLog
@@ -1,3 +1,8 @@
+2023-03-15  Nick Clifton  <nickc@redhat.com>
+
+       PR 30231
+       * mep-dis.c: Regenerate.
+
 2023-03-15  Nick Clifton  <nickc@redhat.com>
 
        PR 30230

diff --git a/opcodes/mep-dis.c b/opcodes/mep-dis.c
index 3fe827e75deeecea57c5fe6817b20d4c0a433dac..72c6c101bfd9f3d7744e0770a48519aedf568b66 100644 (file)
--- a/opcodes/mep-dis.c
+++ b/opcodes/mep-dis.c
@@ -649,6 +649,20 @@ mep_print_insn (CGEN_CPU_DESC cd, bfd_vma pc, disassemble_info *info)
          mep_config_index = abfd->tdata.elf_obj_data->elf_header->e_flags & EF_MEP_INDEX_MASK;
          /* This instantly redefines MEP_CONFIG, MEP_OMASK, .... MEP_VLIW64 */
 
+         /* mep_config_map is a variable sized array, so we do not know how big it is.
+            The only safe way to check the index therefore is to iterate over the array.
+            We do know that the last entry is all null.  */
+         int i;
+         for (i = 0; i <= mep_config_index; i++)
+           if (mep_config_map[i].name == NULL)
+             break;
+         
+         if (i < mep_config_index)
+           {
+             opcodes_error_handler (_("illegal MEP INDEX setting '%x' in ELF header e_flags field"), mep_config_index);
+             mep_config_index = 0;
+           }
+         
          cop_type = abfd->tdata.elf_obj_data->elf_header->e_flags & EF_MEP_COP_MASK;
          if (cop_type == EF_MEP_COP_IVC2)
            ivc2 = 1;