[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 19/33] target/i386: Use assert() to sanity-check b1 in SSE decode
From: |
Peter Maydell |
Subject: |
[PULL 19/33] target/i386: Use assert() to sanity-check b1 in SSE decode |
Date: |
Wed, 15 Dec 2021 10:40:35 +0000 |
In the SSE decode function gen_sse(), we combine a byte
'b' and a value 'b1' which can be [0..3], and switch on them:
b |= (b1 << 8);
switch (b) {
...
default:
unknown_op:
gen_unknown_opcode(env, s);
return;
}
In three cases inside this switch, we were then also checking for
"if (b1 >= 2) { goto unknown_op; }".
However, this can never happen, because the 'case' values in each place
are 0x0nn or 0x1nn and the switch will have directed the b1 == (2, 3)
cases to the default already.
This check was added in commit c045af25a52e9 in 2010; the added code
was unnecessary then as well, and was apparently intended only to
ensure that we never accidentally ended up indexing off the end
of an sse_op_table with only 2 entries as a result of future bugs
in the decode logic.
Change the checks to assert() instead, and make sure they're always
immediately before the array access they are protecting.
Fixes: Coverity CID 1460207
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
target/i386/tcg/translate.c | 12 +++---------
1 file changed, 3 insertions(+), 9 deletions(-)
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index e9e14515409..05f9336c9b9 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -3519,9 +3519,6 @@ static void gen_sse(CPUX86State *env, DisasContext *s,
int b,
case 0x171: /* shift xmm, im */
case 0x172:
case 0x173:
- if (b1 >= 2) {
- goto unknown_op;
- }
val = x86_ldub_code(env, s);
if (is_xmm) {
tcg_gen_movi_tl(s->T0, val);
@@ -3540,6 +3537,7 @@ static void gen_sse(CPUX86State *env, DisasContext *s,
int b,
offsetof(CPUX86State, mmx_t0.MMX_L(1)));
op1_offset = offsetof(CPUX86State,mmx_t0);
}
+ assert(b1 < 2);
sse_fn_epp = sse_op_table2[((b - 1) & 3) * 8 +
(((modrm >> 3)) & 7)][b1];
if (!sse_fn_epp) {
@@ -3770,10 +3768,8 @@ static void gen_sse(CPUX86State *env, DisasContext *s,
int b,
rm = modrm & 7;
reg = ((modrm >> 3) & 7) | REX_R(s);
mod = (modrm >> 6) & 3;
- if (b1 >= 2) {
- goto unknown_op;
- }
+ assert(b1 < 2);
sse_fn_epp = sse_op_table6[b].op[b1];
if (!sse_fn_epp) {
goto unknown_op;
@@ -4200,10 +4196,8 @@ static void gen_sse(CPUX86State *env, DisasContext *s,
int b,
rm = modrm & 7;
reg = ((modrm >> 3) & 7) | REX_R(s);
mod = (modrm >> 6) & 3;
- if (b1 >= 2) {
- goto unknown_op;
- }
+ assert(b1 < 2);
sse_fn_eppi = sse_op_table7[b].op[b1];
if (!sse_fn_eppi) {
goto unknown_op;
--
2.25.1
- [PULL 12/33] target/arm: Split arm_pre_translate_insn, (continued)
- [PULL 12/33] target/arm: Split arm_pre_translate_insn, Peter Maydell, 2021/12/15
- [PULL 14/33] target/arm: Split compute_fsr_fsc out of arm_deliver_fault, Peter Maydell, 2021/12/15
- [PULL 09/33] target/arm: Hoist pc_next to a local variable in aarch64_tr_translate_insn, Peter Maydell, 2021/12/15
- [PULL 15/33] target/arm: Take an exception if PC is misaligned, Peter Maydell, 2021/12/15
- [PULL 16/33] target/arm: Assert thumb pc is aligned, Peter Maydell, 2021/12/15
- [PULL 17/33] target/arm: Suppress bp for exceptions with more priority, Peter Maydell, 2021/12/15
- [PULL 20/33] include/hw/i386: Don't include qemu-common.h in .h files, Peter Maydell, 2021/12/15
- [PULL 21/33] target/hexagon/cpu.h: don't include qemu-common.h, Peter Maydell, 2021/12/15
- [PULL 13/33] target/arm: Advance pc for arch single-step exception, Peter Maydell, 2021/12/15
- [PULL 18/33] tests/tcg: Add arm and aarch64 pc alignment tests, Peter Maydell, 2021/12/15
- [PULL 19/33] target/i386: Use assert() to sanity-check b1 in SSE decode,
Peter Maydell <=
- [PULL 24/33] target/arm: Correct calculation of tlb range invalidate length, Peter Maydell, 2021/12/15
- [PULL 27/33] hw/arm/virt: Remove device tree restriction for virtio-iommu, Peter Maydell, 2021/12/15
- [PULL 28/33] hw/arm/virt: Reject instantiation of multiple IOMMUs, Peter Maydell, 2021/12/15
- [PULL 08/33] hw/intc/arm_gicv3: Introduce CONFIG_ARM_GIC_TCG Kconfig selector, Peter Maydell, 2021/12/15
- [PULL 32/33] tests/acpi: add expected blobs for VIOT test on q35 machine, Peter Maydell, 2021/12/15
- [PULL 25/33] hw/net: npcm7xx_emc fix missing queue_flush, Peter Maydell, 2021/12/15
- [PULL 26/33] hw/arm/virt-acpi-build: Add VIOT table for virtio-iommu, Peter Maydell, 2021/12/15
- [PULL 22/33] target/rx/cpu.h: Don't include qemu-common.h, Peter Maydell, 2021/12/15
- [PULL 23/33] hw/arm: Don't include qemu-common.h unnecessarily, Peter Maydell, 2021/12/15
- [PULL 30/33] tests/acpi: allow updates of VIOT expected data files, Peter Maydell, 2021/12/15