From nobody Tue Oct 28 02:10:43 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1516114353304436.713507399072; Tue, 16 Jan 2018 06:52:33 -0800 (PST) Received: from localhost ([::1]:39422 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ebSbB-0005cx-R5 for importer@patchew.org; Tue, 16 Jan 2018 09:52:25 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50393) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ebS46-00033p-2e for qemu-devel@nongnu.org; Tue, 16 Jan 2018 09:18:20 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ebS44-0004kJ-Pr for qemu-devel@nongnu.org; Tue, 16 Jan 2018 09:18:14 -0500 Received: from mail-wm0-x244.google.com ([2a00:1450:400c:c09::244]:44170) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1ebS44-0004iS-Ge for qemu-devel@nongnu.org; Tue, 16 Jan 2018 09:18:12 -0500 Received: by mail-wm0-x244.google.com with SMTP id t74so8750859wme.3 for ; Tue, 16 Jan 2018 06:18:12 -0800 (PST) Received: from 640k.lan (dynamic-adsl-78-12-229-84.clienti.tiscali.it. [78.12.229.84]) by smtp.gmail.com with ESMTPSA id u10sm1537758wrg.6.2018.01.16.06.18.09 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 16 Jan 2018 06:18:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=SBiUxsRwJdIfaKAt9vXbp84X/Umzm/STps26F2h9u9M=; b=B1F8tNOwNru9m4/8+PXn780XsOfv77EB3Rlcrt+c/wHApr0Q+85F6IP92Qis6a9Vf8 6FjmPxT4wp10Q7sQ+tdFiO6oNF/Hq+d5gMN6Q8W/cDgzqDj0cP2NN5XRRUZ7uziiePE2 3M3gWQEoqOV/oJuCvz4GH8Aua5bgI1BWhu6ksVIsBz0rJgkqpgI7n5NNAKOkl1AbA4G4 Qc3ev0lg61/GjfNHKpOa/292i6EtwfVcktgAZX+BdE5huKVQlvwrgXBB4ZNiFfqGYC+p 2F+zccfswhEBClUY1yRowCpCv88XJ2R1Psb3ORLMQ8u33rv+DfyzoGczE9QdaF3yjO8m +yxA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :in-reply-to:references:mime-version:content-transfer-encoding; bh=SBiUxsRwJdIfaKAt9vXbp84X/Umzm/STps26F2h9u9M=; b=eTuYKcvnfR8R90rqauBvY8Pz9R+dbzBnz+1HLAn3w5L/PakYTJVcAldeGKKtQnMNAQ mz1uTOSaQvfhhwNX1Jmap7l8sSRpxrYZoRGPWKdHPp9CrYenmiHOGBm4fPZeSueMMfiq HlkS7/434aqAPTbfBXBsoMlTqQEjI3UhBz15AH5/5KD9Bv/dYacCs7JPmbybAusPu0/E o9Sf2J5hWXIchYlmsj7qoBNVMc8BlFPIAfBfeKOElqPtB5huS45U+ddTkmelfRFMYrEG nnsSoI35LDXz0ba1prL/bzSC5qJwLsCYXO659AD0OeD9GIsTXk+XDcJ4BOVM1lDcWRTi 88iA== X-Gm-Message-State: AKwxytebkUfImcCgUG/W6YhVzZGzUQ2c1WpnrUPidvSm0RUjz5wdFu2a QoHol0zFaWaw4Hn2OEHBoIOTRwbO X-Google-Smtp-Source: ACJfBotH0vXu6b586FWNDZQbZOlt4XwDhL3yHbqv1yq4G2OtTpVcAecgVHreWhpmPoXlp5b7skLe5w== X-Received: by 10.28.69.212 with SMTP id l81mr13595952wmi.65.1516112291196; Tue, 16 Jan 2018 06:18:11 -0800 (PST) From: Paolo Bonzini To: qemu-devel@nongnu.org Date: Tue, 16 Jan 2018 15:17:06 +0100 Message-Id: <1516112253-14480-25-git-send-email-pbonzini@redhat.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1516112253-14480-1-git-send-email-pbonzini@redhat.com> References: <1516112253-14480-1-git-send-email-pbonzini@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2a00:1450:400c:c09::244 Subject: [Qemu-devel] [PULL 24/51] disas/s390: fix global-buffer-overflow X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZohoMail: RDKM_2 RSF_0 Z_629925259 SPT_0 From: Marc-Andr=C3=A9 Lureau Spotted thanks to ASAN: =3D=3D25226=3D=3DERROR: AddressSanitizer: global-buffer-overflow on address= 0x556715a1f120 at pc 0x556714b6f6b1 bp 0x7ffcdfac1360 sp 0x7ffcdfac1350 READ of size 1 at 0x556715a1f120 thread T0 #0 0x556714b6f6b0 in init_disasm /home/elmarco/src/qemu/disas/s390.c:219 #1 0x556714b6fa6a in print_insn_s390 /home/elmarco/src/qemu/disas/s390.= c:294 #2 0x55671484d031 in monitor_disas /home/elmarco/src/qemu/disas.c:635 #3 0x556714862ec0 in memory_dump /home/elmarco/src/qemu/monitor.c:1324 #4 0x55671486342a in hmp_memory_dump /home/elmarco/src/qemu/monitor.c:1= 418 #5 0x5567148670be in handle_hmp_command /home/elmarco/src/qemu/monitor.= c:3109 #6 0x5567148674ed in qmp_human_monitor_command /home/elmarco/src/qemu/m= onitor.c:613 #7 0x556714b00918 in qmp_marshal_human_monitor_command /home/elmarco/sr= c/qemu/build/qmp-marshal.c:1704 #8 0x556715138a3e in do_qmp_dispatch /home/elmarco/src/qemu/qapi/qmp-di= spatch.c:104 #9 0x556715138f83 in qmp_dispatch /home/elmarco/src/qemu/qapi/qmp-dispa= tch.c:131 #10 0x55671485cf88 in handle_qmp_command /home/elmarco/src/qemu/monitor= .c:3839 #11 0x55671514e80b in json_message_process_token /home/elmarco/src/qemu= /qobject/json-streamer.c:105 #12 0x5567151bf2dc in json_lexer_feed_char /home/elmarco/src/qemu/qobje= ct/json-lexer.c:323 #13 0x5567151bf827 in json_lexer_feed /home/elmarco/src/qemu/qobject/js= on-lexer.c:373 #14 0x55671514ee62 in json_message_parser_feed /home/elmarco/src/qemu/q= object/json-streamer.c:124 #15 0x556714854b1f in monitor_qmp_read /home/elmarco/src/qemu/monitor.c= :3881 #16 0x556715045440 in qemu_chr_be_write_impl /home/elmarco/src/qemu/cha= rdev/char.c:172 #17 0x556715047184 in qemu_chr_be_write /home/elmarco/src/qemu/chardev/= char.c:184 #18 0x55671505a8e6 in tcp_chr_read /home/elmarco/src/qemu/chardev/char-= socket.c:440 #19 0x5567150943c3 in qio_channel_fd_source_dispatch /home/elmarco/src/= qemu/io/channel-watch.c:84 #20 0x7fb90292b90b in g_main_dispatch ../glib/gmain.c:3182 #21 0x7fb90292c7ac in g_main_context_dispatch ../glib/gmain.c:3847 #22 0x556715162eca in glib_pollfds_poll /home/elmarco/src/qemu/util/mai= n-loop.c:214 #23 0x556715163001 in os_host_main_loop_wait /home/elmarco/src/qemu/uti= l/main-loop.c:261 #24 0x5567151631fa in main_loop_wait /home/elmarco/src/qemu/util/main-l= oop.c:515 #25 0x556714ad6d3b in main_loop /home/elmarco/src/qemu/vl.c:1950 #26 0x556714ade329 in main /home/elmarco/src/qemu/vl.c:4865 #27 0x7fb8fe5c9009 in __libc_start_main (/lib64/libc.so.6+0x21009) #28 0x5567147af4d9 in _start (/home/elmarco/src/qemu/build/s390x-softmm= u/qemu-system-s390x+0xf674d9) 0x556715a1f120 is located 32 bytes to the left of global variable 'char_hci= _type_info' defined in '/home/elmarco/src/qemu/hw/bt/hci-csr.c:493:23' (0x5= 56715a1f140) of size 104 0x556715a1f120 is located 8 bytes to the right of global variable 's390_opc= odes' defined in '/home/elmarco/src/qemu/disas/s390.c:860:33' (0x556715a152= 80) of size 40600 This fix is based on Andreas Arnez upstream commit: https://sourceware.org/git/gitweb.cgi?p=3Dbinutils-gdb.git;a=3Dcommitdiff;h= =3D9ace48f3d7d80ce09c5df60cccb433470410b11b 2014-08-19 Andreas Arnez * s390-dis.c (init_disasm): Simplify initialization of opc_index[]. This also fixes an access after the last element of s390_opcodes[]. Signed-off-by: Marc-Andr=C3=A9 Lureau Message-Id: <20180104160523.22995-19-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini --- disas/s390.c | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/disas/s390.c b/disas/s390.c index 1f167d2..6393860 100644 --- a/disas/s390.c +++ b/disas/s390.c @@ -207,18 +207,14 @@ static int opc_index[256]; static void init_disasm (struct disassemble_info *info) { - const struct s390_opcode *opcode; - const struct s390_opcode *opcode_end; + int i; =20 memset (opc_index, 0, sizeof (opc_index)); - opcode_end =3D s390_opcodes + s390_num_opcodes; - for (opcode =3D s390_opcodes; opcode < opcode_end; opcode++) - { - opc_index[(int) opcode->opcode[0]] =3D opcode - s390_opcodes; - while ((opcode < opcode_end) && - (opcode[1].opcode[0] =3D=3D opcode->opcode[0])) - opcode++; - } + + /* Reverse order, such that each opc_index ends up pointing to the + first matching entry instead of the last. */ + for (i =3D s390_num_opcodes; i--; ) + opc_index[s390_opcodes[i].opcode[0]] =3D i; =20 #ifdef QEMU_DISABLE switch (info->mach) --=20 1.8.3.1