portugalfuturista/rizin
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix potentially invalid memcpy in xtensa (#4360)

Browse source 
Regression from bde374dad6:
When memcpy is a macro (e.g. on macOS <= 10.12), the commas are
interpreted as macro argument delimiters. Since length_table is never
mutated, we can revert the change and use it as a constant buffer.

Partially addresses #4352
This commit is contained in:
Florian Märkl 2024-03-16 12:38:45 +01:00 committed by GitHub
parent 2195bbc472
commit 14238ac591
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 4 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
librz/arch/p_gnu/analysis/analysis_xtensa_gnu.c
View file

@ -13,7 +13,6 @@
#define XTENSA_MAX_LENGTH 8
typedef struct {
int length_table[16];
xtensa_insnbuf insn_buffer;
xtensa_insnbuf slot_buffer;
} XtensaContext;
@ -21,16 +20,15 @@ typedef struct {
static bool xtensa_init(void **user) {
XtensaContext *ctx = RZ_NEW0(XtensaContext);
rz_return_val_if_fail(ctx, false);
memcpy(ctx->length_table, (int[16]){ 3, 3, 3, 3, 3, 3, 3, 3, 2, 2, 2, 2, 2, 2, 8, 8 }, sizeof(ctx->length_table));
ctx->insn_buffer = NULL;
ctx->slot_buffer = NULL;
*user = ctx;
return true;
}
static int xtensa_length(RzAnalysis *a, const ut8 *insn) {
XtensaContext *ctx = (XtensaContext *)a->plugin_data;
return ctx->length_table[*insn & 0xf];
static int xtensa_length(const ut8 *insn) {
static const int length_table[16] = { 3, 3, 3, 3, 3, 3, 3, 3, 2, 2, 2, 2, 2, 2, 8, 8 };
return length_table[*insn & 0xf];
}
static inline ut64 xtensa_offset(ut64 addr, const ut8 *buf) {
@ -1962,7 +1960,7 @@ static int xtensa_op(RzAnalysis *analysis, RzAnalysisOp *op, ut64 addr, const ut
return 1;
}
op->size = xtensa_length(analysis, buf_original);
op->size = xtensa_length(buf_original);
if (op->size > len_original) {
return 1;
}