]> git.ipfire.org Git - thirdparty/qemu.git/commit
target/arm: Avoid shifts by -1 in tszimm_shr() and tszimm_shl()
authorPeter Maydell <peter.maydell@linaro.org>
Mon, 22 Jul 2024 17:29:56 +0000 (18:29 +0100)
committerMichael Tokarev <mjt@tls.msk.ru>
Fri, 2 Aug 2024 07:24:18 +0000 (10:24 +0300)
commit0867c7fa336c72698f4f64801561bd69392d3ea9
treeb4fe7f59d970c7d27d7331eb42248cc9362806a9
parent59b4c2378cebe31bfee3c69ed97db8abaf8b46f6
target/arm: Avoid shifts by -1 in tszimm_shr() and tszimm_shl()

The function tszimm_esz() returns a shift amount, or possibly -1 in
certain cases that correspond to unallocated encodings in the
instruction set.  We catch these later in the trans_ functions
(generally with an "a-esz < 0" check), but before we do the
decodetree-generated code will also call tszimm_shr() or tszimm_sl(),
which will use the tszimm_esz() return value as a shift count without
checking that it is not negative, which is undefined behaviour.

Avoid the UB by checking the return value in tszimm_shr() and
tszimm_shl().

Cc: qemu-stable@nongnu.org
Resolves: Coverity CID 15476171547694
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240722172957.1041231-4-peter.maydell@linaro.org
(cherry picked from commit 76916dfa89e8900639c1055c07a295c06628a0bc)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
target/arm/translate-sve.c