]> git.ipfire.org Git - thirdparty/qemu.git/commit
target/arm: Avoid shifts by -1 in tszimm_shr() and tszimm_shl()
authorPeter Maydell <peter.maydell@linaro.org>
Mon, 22 Jul 2024 17:29:56 +0000 (18:29 +0100)
committerMichael Tokarev <mjt@tls.msk.ru>
Wed, 28 Aug 2024 05:37:28 +0000 (08:37 +0300)
commit540a70d2c462feb16221c1cea3cdf18db552e64e
tree926c567429cc5810076e7e4a8bf6af108c6bdd99
parent188b8ad0e44c858732a54ee2f1c7ddd8be7b483a
target/arm: Avoid shifts by -1 in tszimm_shr() and tszimm_shl()

The function tszimm_esz() returns a shift amount, or possibly -1 in
certain cases that correspond to unallocated encodings in the
instruction set.  We catch these later in the trans_ functions
(generally with an "a-esz < 0" check), but before we do the
decodetree-generated code will also call tszimm_shr() or tszimm_sl(),
which will use the tszimm_esz() return value as a shift count without
checking that it is not negative, which is undefined behaviour.

Avoid the UB by checking the return value in tszimm_shr() and
tszimm_shl().

Cc: qemu-stable@nongnu.org
Resolves: Coverity CID 15476171547694
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240722172957.1041231-4-peter.maydell@linaro.org
(cherry picked from commit 76916dfa89e8900639c1055c07a295c06628a0bc)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
target/arm/tcg/translate-sve.c