From 13c9c48599ebc8ad2f3a1fb9f672740219cd3841 Mon Sep 17 00:00:00 2001 From: Alan Modra Date: Wed, 11 Dec 2019 13:32:25 +1030 Subject: [PATCH] bfd signed overflow fixes Aimed at quietening ubsan. include/ * opcode/mmix.h (PUSHGO_INSN_BYTE): Make unsigned. (GO_INSN_BYTE, SETL_INSN_BYTE, INCML_INSN_BYTE, INCMH_INSN_BYTE), (INCH_INSN_BYTE, SWYM_INSN_BYTE, JMP_INSN_BYTE): Likewise. bfd/ * elf32-rx.c (elf32_rx_relax_section): Avoid signed overflow. * libaout.h (N_SET_INFO, N_SET_FLAGS): Likewise. * netbsd.h (write_object_contents): Likewise. * elf32-arm.c (bfd_elf32_arm_vfp11_erratum_scan): Likewise. * libhppa.h (HPPA_R_CONSTANT): Don't signed extend with shifts. (stm32l4xx_create_replacing_stub_vldm): Don't truncate high bits with shifts. * elf32-nds32.h (R_NDS32_RELAX_ENTRY_DISABLE_RELAX_FLAG): Define using 1u shifted left. Ditto for other macros. * mmo.c (LOP): Make unsigned. --- bfd/ChangeLog | 13 +++++++++++++ bfd/elf32-arm.c | 18 +++++++++--------- bfd/elf32-nds32.h | 24 ++++++++++++------------ bfd/elf32-rx.c | 4 ++-- bfd/libaout.h | 4 ++-- bfd/libhppa.h | 2 +- bfd/mmo.c | 2 +- bfd/netbsd.h | 2 +- include/ChangeLog | 6 ++++++ include/opcode/mmix.h | 16 ++++++++-------- 10 files changed, 55 insertions(+), 36 deletions(-) diff --git a/bfd/ChangeLog b/bfd/ChangeLog index bdf33b67838..5933a05e7e8 100644 --- a/bfd/ChangeLog +++ b/bfd/ChangeLog @@ -1,3 +1,16 @@ +2019-12-11 Alan Modra + + * elf32-rx.c (elf32_rx_relax_section): Avoid signed overflow. + * libaout.h (N_SET_INFO, N_SET_FLAGS): Likewise. + * netbsd.h (write_object_contents): Likewise. + * elf32-arm.c (bfd_elf32_arm_vfp11_erratum_scan): Likewise. + * libhppa.h (HPPA_R_CONSTANT): Don't signed extend with shifts. + (stm32l4xx_create_replacing_stub_vldm): Don't truncate high bits + with shifts. + * elf32-nds32.h (R_NDS32_RELAX_ENTRY_DISABLE_RELAX_FLAG): Define + using 1u shifted left. Ditto for other macros. + * mmo.c (LOP): Make unsigned. + 2019-12-11 Alan Modra * libbfd.c (bfd_get_8): Return a bfd_vma. diff --git a/bfd/elf32-arm.c b/bfd/elf32-arm.c index 37b5b64dc60..ebe199c2494 100644 --- a/bfd/elf32-arm.c +++ b/bfd/elf32-arm.c @@ -8506,14 +8506,14 @@ bfd_elf32_arm_vfp11_erratum_scan (bfd *abfd, struct bfd_link_info *link_info) { unsigned int next_i = i + 4; unsigned int insn = bfd_big_endian (abfd) - ? (contents[i] << 24) - | (contents[i + 1] << 16) - | (contents[i + 2] << 8) - | contents[i + 3] - : (contents[i + 3] << 24) - | (contents[i + 2] << 16) - | (contents[i + 1] << 8) - | contents[i]; + ? (((unsigned) contents[i] << 24) + | (contents[i + 1] << 16) + | (contents[i + 2] << 8) + | contents[i + 3]) + : (((unsigned) contents[i + 3] << 24) + | (contents[i + 2] << 16) + | (contents[i + 1] << 8) + | contents[i]); unsigned int writemask = 0; enum bfd_arm_vfp11_pipe vpipe; @@ -19356,7 +19356,7 @@ stm32l4xx_create_replacing_stub_vldm (struct elf32_arm_link_hash_table * htab, const bfd_byte *const initial_insn_addr, bfd_byte *const base_stub_contents) { - int num_words = ((unsigned int) initial_insn << 24) >> 24; + int num_words = initial_insn & 0xff; bfd_byte *current_stub_contents = base_stub_contents; BFD_ASSERT (is_thumb2_vldm (initial_insn)); diff --git a/bfd/elf32-nds32.h b/bfd/elf32-nds32.h index f2443b2e989..7a5134fc7d9 100644 --- a/bfd/elf32-nds32.h +++ b/bfd/elf32-nds32.h @@ -31,45 +31,45 @@ extern "C" { /* Relocation flags for R_NDS32_ERLAX_ENTRY. */ /* Set if relax on this section is done or disabled. */ -#define R_NDS32_RELAX_ENTRY_DISABLE_RELAX_FLAG (1 << 31) +#define R_NDS32_RELAX_ENTRY_DISABLE_RELAX_FLAG (1u << 31) /* Optimize for performance. */ -#define R_NDS32_RELAX_ENTRY_OPTIMIZE_FLAG (1 << 30) +#define R_NDS32_RELAX_ENTRY_OPTIMIZE_FLAG (1u << 30) /* Optimize for size. Branch destination 4-byte adjustment may be disabled. */ -#define R_NDS32_RELAX_ENTRY_OPTIMIZE_FOR_SPACE_FLAG (1 << 29) +#define R_NDS32_RELAX_ENTRY_OPTIMIZE_FOR_SPACE_FLAG (1u << 29) /* To distinguish the assembly code generated by compiler or written manually. */ -#define R_NDS32_RELAX_ENTRY_VERBATIM_FLAG (1 << 28) +#define R_NDS32_RELAX_ENTRY_VERBATIM_FLAG (1u << 28) /* Two bits for ICT to comply with files without directive. */ /* ICT small model. */ -#define R_NDS32_RELAX_ENTRY_ICT_SMALL (0x2 << 4) +#define R_NDS32_RELAX_ENTRY_ICT_SMALL (0x2u << 4) /* ICT large model. */ -#define R_NDS32_RELAX_ENTRY_ICT_LARGE (0x3 << 4) +#define R_NDS32_RELAX_ENTRY_ICT_LARGE (0x3u << 4) /* Mask for get ict bits. */ -#define R_NDS32_RELAX_ENTRY_ICT_MASK (0x3 << 4) +#define R_NDS32_RELAX_ENTRY_ICT_MASK (0x3u << 4) /* Relocation flags for R_NDS32_INSN16. */ /* Tag the nop16 can be removed. */ -#define R_NDS32_INSN16_CONVERT_FLAG (1 << 0) +#define R_NDS32_INSN16_CONVERT_FLAG (1u << 0) /* Convert a gp-relative access (e.g., lwi.gp) to fp-as-gp access (lwi37.fp). This value is used by linker internally only. It's fine to change the vlaue. */ -#define R_NDS32_INSN16_FP7U2_FLAG (1 << 1) +#define R_NDS32_INSN16_FP7U2_FLAG (1u << 1) /* Relocation flags for R_NDS32_RELAX_REGION_OMIT_FP_START/END. */ /* OMIT_FP_FLAG marks the region for applying fp-as-gp optimization. */ -#define R_NDS32_RELAX_REGION_OMIT_FP_FLAG (1 << 0) +#define R_NDS32_RELAX_REGION_OMIT_FP_FLAG (1u << 0) /* NOT_OMIT_FP_FLAG is set if this region is not worth for fp-as-gp. */ -#define R_NDS32_RELAX_REGION_NOT_OMIT_FP_FLAG (1 << 1) +#define R_NDS32_RELAX_REGION_NOT_OMIT_FP_FLAG (1u << 1) /* A Innermost loop region. Some optimizations is suppressed in this region due to performance drop. */ -#define R_NDS32_RELAX_REGION_INNERMOST_LOOP_FLAG (1 << 4) +#define R_NDS32_RELAX_REGION_INNERMOST_LOOP_FLAG (1u << 4) /* Tag range for LOADSTORE relocation. */ enum diff --git a/bfd/elf32-rx.c b/bfd/elf32-rx.c index a1a5ce11be1..1b7b35b01f0 100644 --- a/bfd/elf32-rx.c +++ b/bfd/elf32-rx.c @@ -2932,9 +2932,9 @@ elf32_rx_relax_section (bfd * abfd, break; case 0: #if RX_OPCODE_BIG_ENDIAN - imm_val = (ip[0] << 24) | (ip[1] << 16) | (ip[2] << 8) | ip[3]; + imm_val = ((unsigned) ip[0] << 24) | (ip[1] << 16) | (ip[2] << 8) | ip[3]; #else - imm_val = (ip[3] << 24) | (ip[2] << 16) | (ip[1] << 8) | ip[0]; + imm_val = ((unsigned) ip[3] << 24) | (ip[2] << 16) | (ip[1] << 8) | ip[0]; #endif break; } diff --git a/bfd/libaout.h b/bfd/libaout.h index 5b6424c7094..0702ed37132 100644 --- a/bfd/libaout.h +++ b/bfd/libaout.h @@ -309,7 +309,7 @@ enum machine_type # define N_SET_INFO(execp, magic, type, flags) \ ((execp)->a_info = ((magic) & 0xffff) \ | (((int)(type) & 0xff) << 16) \ - | (((flags) & 0xff) << 24)) + | (((flags) & 0xffu) << 24)) #endif #ifndef N_SET_DYNAMIC @@ -332,7 +332,7 @@ enum machine_type #ifndef N_SET_FLAGS # define N_SET_FLAGS(execp, flags) \ ((execp)->a_info = \ - ((execp)->a_info & 0x00ffffff) | (((flags) & 0xff) << 24)) + ((execp)->a_info & 0x00ffffff) | (((flags) & 0xffu) << 24)) #endif typedef struct aout_symbol diff --git a/bfd/libhppa.h b/bfd/libhppa.h index df50b7d44c0..632f5243d0b 100644 --- a/bfd/libhppa.h +++ b/bfd/libhppa.h @@ -148,7 +148,7 @@ enum hppa_reloc_expr_type_alt #define HPPA_R_ARG_RELOC(a) \ (((a) >> 22) & 0x3ff) #define HPPA_R_CONSTANT(a) \ - ((((bfd_signed_vma)(a)) << (BFD_ARCH_SIZE-22)) >> (BFD_ARCH_SIZE-22)) + ((((bfd_signed_vma) (a) & 0x3fffff) ^ 0x200000) - 0x200000) #define HPPA_R_ADDEND(r, c) \ (((r) << 22) + ((c) & 0x3fffff)) diff --git a/bfd/mmo.c b/bfd/mmo.c index 736ee4bed81..d175befd0db 100644 --- a/bfd/mmo.c +++ b/bfd/mmo.c @@ -207,7 +207,7 @@ EXAMPLE #include "elf/mmix.h" #include "opcode/mmix.h" -#define LOP 0x98 +#define LOP 0x98u #define LOP_QUOTE 0 #define LOP_LOC 1 #define LOP_SKIP 2 diff --git a/bfd/netbsd.h b/bfd/netbsd.h index b5a13026c56..3e981401cab 100644 --- a/bfd/netbsd.h +++ b/bfd/netbsd.h @@ -104,7 +104,7 @@ MY (write_object_contents) (bfd *abfd) /* XXX aren't there any macro to change byteorder of a word independent of the host's or target's endiannesses? */ execp->a_info - = (execp->a_info & 0xff) << 24 | (execp->a_info & 0xff00) << 8 + = (execp->a_info & 0xffu) << 24 | (execp->a_info & 0xff00) << 8 | (execp->a_info & 0xff0000) >> 8 | (execp->a_info & 0xff000000) >> 24; #endif diff --git a/include/ChangeLog b/include/ChangeLog index 98815e88b29..52cdc0407ca 100644 --- a/include/ChangeLog +++ b/include/ChangeLog @@ -1,3 +1,9 @@ +2019-12-11 Alan Modra + + * opcode/mmix.h (PUSHGO_INSN_BYTE): Make unsigned. + (GO_INSN_BYTE, SETL_INSN_BYTE, INCML_INSN_BYTE, INCMH_INSN_BYTE), + (INCH_INSN_BYTE, SWYM_INSN_BYTE, JMP_INSN_BYTE): Likewise. + 2019-12-11 Alan Modra * dis-asm.h (INSN_HAS_RELOC, DISASSEMBLE_DATA), diff --git a/include/opcode/mmix.h b/include/opcode/mmix.h index 4f6f0bb1d7c..0f08262181e 100644 --- a/include/opcode/mmix.h +++ b/include/opcode/mmix.h @@ -173,14 +173,14 @@ extern const struct mmix_spec_reg mmix_spec_regs[]; #define COND_INV_BIT 0x8 #define PRED_INV_BIT 0x10 -#define PUSHGO_INSN_BYTE 0xbe -#define GO_INSN_BYTE 0x9e -#define SETL_INSN_BYTE 0xe3 -#define INCML_INSN_BYTE 0xe6 -#define INCMH_INSN_BYTE 0xe5 -#define INCH_INSN_BYTE 0xe4 -#define SWYM_INSN_BYTE 0xfd -#define JMP_INSN_BYTE 0xf0 +#define PUSHGO_INSN_BYTE 0xbeu +#define GO_INSN_BYTE 0x9eu +#define SETL_INSN_BYTE 0xe3u +#define INCML_INSN_BYTE 0xe6u +#define INCMH_INSN_BYTE 0xe5u +#define INCH_INSN_BYTE 0xe4u +#define SWYM_INSN_BYTE 0xfdu +#define JMP_INSN_BYTE 0xf0u /* We can have 256 - 32 (local registers) - 1 ($255 is not allocatable) global registers. */ -- 2.30.2