mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add more boundary checking to sse3/4 parsing

Browse Source 
ssse3 uses tables with only two entries per op, but it is indexed
with b1 which can contain variables upto 3. This happens when ssse3
or sse4 are used with REP* prefixes.

Add boundary checking for this case.

Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
This commit is contained in:
Andi Kleen 2010-06-27 00:06:11 +02:00 committed by Aurelien Jarno
parent 4c4fd3f852
commit c045af25a5
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
target-i386/translate.c
View File

@ -3472,6 +3472,9 @@ static void gen_sse(DisasContext *s, int b, target_ulong pc_start, int rex_r)
case 0x171: /* shift xmm, im */
case 0x172:
case 0x173:
if (b1 >= 2) {
goto illegal_op;
}
val = ldub_code(s->pc++);
if (is_xmm) {
gen_op_movl_T0_im(val);
@ -3699,6 +3702,9 @@ static void gen_sse(DisasContext *s, int b, target_ulong pc_start, int rex_r)
rm = modrm & 7;
reg = ((modrm >> 3) & 7) | rex_r;
mod = (modrm >> 6) & 3;
if (b1 >= 2) {
goto illegal_op;
}
sse_op2 = sse_op_table6[b].op[b1];
if (!sse_op2)
@ -3798,6 +3804,9 @@ static void gen_sse(DisasContext *s, int b, target_ulong pc_start, int rex_r)
rm = modrm & 7;
reg = ((modrm >> 3) & 7) | rex_r;
mod = (modrm >> 6) & 3;
if (b1 >= 2) {
goto illegal_op;
}
sse_op2 = sse_op_table7[b].op[b1];
if (!sse_op2)