From: Alan Modra <amodra@gmail.com>
Date: Mon, 31 Aug 2020 08:04:39 +0000 (+0930)
Subject: PR26510 UBSAN: tc-z8k.c left shift of negative value
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=06de2e0da24a0f0fdc9b38f8308ec909453c4ee8;p=binutils-gdb.git

PR26510 UBSAN: tc-z8k.c left shift of negative value

This also fixes the packing of the nibble buffer, which contains
rubbish in the top 4 bits of each element.

	PR 26510
	* config/tc-z8k.c (buffer): Use unsigned char.
	(apply_fix): Use unsigned char* pointers.
	(build_bytes): Likewise and mask nibbles when packing.
---

diff --git a/gas/ChangeLog b/gas/ChangeLog
index 8642101aea9..80df2b32ca4 100644
--- a/gas/ChangeLog
+++ b/gas/ChangeLog
@@ -1,3 +1,10 @@
+2020-08-31  Alan Modra  <amodra@gmail.com>
+
+	PR 26510
+	* config/tc-z8k.c (buffer): Use unsigned char.
+	(apply_fix): Use unsigned char* pointers.
+	(build_bytes): Likewise and mask nibbles when packing.
+
 2020-08-31  Alan Modra  <amodra@gmail.com>
 
 	PR 26503
diff --git a/gas/config/tc-z8k.c b/gas/config/tc-z8k.c
index 60e1d05cdbf..58a69f63e5b 100644
--- a/gas/config/tc-z8k.c
+++ b/gas/config/tc-z8k.c
@@ -953,7 +953,7 @@ get_specific (opcode_entry_type *opcode, op_type *operands)
     return 0;
 }
 
-static char buffer[20];
+static unsigned char buffer[20];
 
 static void
 newfix (int ptr, bfd_reloc_code_real_type type, int size, expressionS *operand)
@@ -984,9 +984,9 @@ newfix (int ptr, bfd_reloc_code_real_type type, int size, expressionS *operand)
     }
 }
 
-static char *
-apply_fix (char *ptr, bfd_reloc_code_real_type type, expressionS *operand,
-	   int size)
+static unsigned char *
+apply_fix (unsigned char *ptr, bfd_reloc_code_real_type type,
+	   expressionS *operand, int size)
 {
   long n = operand->X_add_number;
 
@@ -1020,7 +1020,7 @@ apply_fix (char *ptr, bfd_reloc_code_real_type type, expressionS *operand,
 static void
 build_bytes (opcode_entry_type *this_try, struct z8k_op *operand ATTRIBUTE_UNUSED)
 {
-  char *output_ptr = buffer;
+  unsigned char *output_ptr = buffer;
   int c;
   int nibble;
   unsigned int *class_ptr;
@@ -1183,12 +1183,12 @@ build_bytes (opcode_entry_type *this_try, struct z8k_op *operand ATTRIBUTE_UNUSE
   /* Copy from the nibble buffer into the frag.  */
   {
     int length = (output_ptr - buffer) / 2;
-    char *src = buffer;
-    char *fragp = frag_more (length);
+    unsigned char *src = buffer;
+    unsigned char *fragp = (unsigned char *) frag_more (length);
 
     while (src < output_ptr)
       {
-	*fragp = (src[0] << 4) | src[1];
+	*fragp = ((src[0] & 0xf) << 4) | (src[1] & 0xf);
 	src += 2;
 	fragp++;
       }