From 1286ab788188bb8f0b0da2a3def4641fb3817f10 Mon Sep 17 00:00:00 2001
From: "H.J. Lu" <hjl.tools@gmail.com>
Date: Fri, 27 Jul 2018 06:35:09 -0700
Subject: [PATCH] x86: Check for more than 2 memory references

For

movsd (%esi), %ss:(%edi), %ss:(%eax)

we got

[hjl@gnu-tools-1 tmp]$ as -o x.o x.s
x.s: Assembler messages:
x.s:1: Error: too many memory references for `movsd'
munmap_chunk(): invalid pointer
x.s:1: Internal error (Aborted).
Please report this bug.
[hjl@gnu-tools-1 tmp]$

struct _i386_insn has

const seg_entry *seg[2];

3 memory references will overflow the seg array.  We should issue an
error if there are more than 2 memory references.

	PR gas/23453
	* config/tc-i386.c (parse_operands): Check for more than 2
	memory references.
	* testsuite/gas/i386/inval.s: Add a movsd test with 3 memory
	references.
	* testsuite/gas/i386/x86-64-inval.s: Likewise.
	* testsuite/gas/i386/inval.l: Updated.
	* testsuite/gas/i386/x86-64-inval.l: Likewise.
---
 gas/ChangeLog                         | 11 +++++++++++
 gas/config/tc-i386.c                  |  7 +++++++
 gas/testsuite/gas/i386/inval.l        |  4 ++++
 gas/testsuite/gas/i386/inval.s        |  3 +++
 gas/testsuite/gas/i386/x86-64-inval.l |  4 ++++
 gas/testsuite/gas/i386/x86-64-inval.s |  3 +++
 6 files changed, 32 insertions(+)

diff --git a/gas/ChangeLog b/gas/ChangeLog
index e8c500a2c0e..0cc4e55d244 100644
--- a/gas/ChangeLog
+++ b/gas/ChangeLog
@@ -1,3 +1,14 @@
+2018-07-26  H.J. Lu  <hongjiu.lu@intel.com>
+
+	PR gas/23453
+	* config/tc-i386.c (parse_operands): Check for more than 2
+	memory references.
+	* testsuite/gas/i386/inval.s: Add a movsd test with 3 memory
+	references.
+	* testsuite/gas/i386/x86-64-inval.s: Likewise.
+	* testsuite/gas/i386/inval.l: Updated.
+	* testsuite/gas/i386/x86-64-inval.l: Likewise.
+
 2018-07-26  H.J. Lu  <hongjiu.lu@intel.com>
 
 	* config/tc-i386.c (check_VecOperations): Initialize
diff --git a/gas/config/tc-i386.c b/gas/config/tc-i386.c
index 9e9c676580a..cc01a588e41 100644
--- a/gas/config/tc-i386.c
+++ b/gas/config/tc-i386.c
@@ -4675,6 +4675,13 @@ parse_operands (char *l, const char *mnemonic)
 	  /* Now parse operand adding info to 'i' as we go along.  */
 	  END_STRING_AND_SAVE (l);
 
+	  if (i.mem_operands > 1)
+	    {
+	      as_bad (_("too many memory references for `%s'"),
+		      mnemonic);
+	      return 0;
+	    }
+
 	  if (intel_syntax)
 	    operand_ok =
 	      i386_intel_operand (token_start,
diff --git a/gas/testsuite/gas/i386/inval.l b/gas/testsuite/gas/i386/inval.l
index d5d8500bbe4..3d52a17d2e5 100644
--- a/gas/testsuite/gas/i386/inval.l
+++ b/gas/testsuite/gas/i386/inval.l
@@ -87,6 +87,7 @@
 .*:97: Error: .*shl.*
 .*:98: Error: .*rol.*
 .*:99: Error: .*rcl.*
+.*:102: Error: .*
 GAS LISTING .*
 
 
@@ -192,3 +193,6 @@ GAS LISTING .*
 [ 	]*[1-9][0-9]*[ 	]+shl \[eax\], 1
 [ 	]*[1-9][0-9]*[ 	]+rol \[ecx\], 2
 [ 	]*[1-9][0-9]*[ 	]+rcl \[edx\], cl
+[ 	]*[1-9][0-9]*[ 	]+
+[ 	]*[1-9][0-9]*[ 	]+\.att_syntax prefix
+[ 	]*[1-9][0-9]*[ 	]+movsd \(%esi\), %ss:\(%edi\), %ss:\(%eax\)
diff --git a/gas/testsuite/gas/i386/inval.s b/gas/testsuite/gas/i386/inval.s
index dbf8b965a13..47655e545ee 100644
--- a/gas/testsuite/gas/i386/inval.s
+++ b/gas/testsuite/gas/i386/inval.s
@@ -97,3 +97,6 @@ movnti word ptr [eax], ax
 	shl [eax], 1
 	rol [ecx], 2
 	rcl [edx], cl
+
+	.att_syntax prefix
+	movsd (%esi), %ss:(%edi), %ss:(%eax)
diff --git a/gas/testsuite/gas/i386/x86-64-inval.l b/gas/testsuite/gas/i386/x86-64-inval.l
index 099cc62e48d..bbb8ba295cb 100644
--- a/gas/testsuite/gas/i386/x86-64-inval.l
+++ b/gas/testsuite/gas/i386/x86-64-inval.l
@@ -110,6 +110,7 @@
 .*:116: Error: .*
 .*:117: Error: .*
 .*:118: Error: .*
+.*:121: Error: .*
 GAS LISTING .*
 
 
@@ -237,3 +238,6 @@ GAS LISTING .*
 [ 	]*116[ 	]+jmpd \[rax\]	\# 32-bit data size not allowed
 [ 	]*117[ 	]+jmpq \[ax\]	\# no 16-bit addressing
 [ 	]*[1-9][0-9]*[ 	]+mov eax,\[rax\+0x876543210\] \# out of range displacement
+[ 	]*[1-9][0-9]*[ 	]+
+[ 	]*[1-9][0-9]*[ 	]+\.att_syntax prefix
+[ 	]*[1-9][0-9]*[ 	]+movsd \(%rsi\), %ss:\(%rdi\), %ss:\(%rax\)
diff --git a/gas/testsuite/gas/i386/x86-64-inval.s b/gas/testsuite/gas/i386/x86-64-inval.s
index 1ce832099be..85c3582d4b2 100644
--- a/gas/testsuite/gas/i386/x86-64-inval.s
+++ b/gas/testsuite/gas/i386/x86-64-inval.s
@@ -116,3 +116,6 @@ movnti word ptr [rax], ax
 	jmpd [rax]	# 32-bit data size not allowed
 	jmpq [ax]	# no 16-bit addressing
 	mov eax,[rax+0x876543210] # out of range displacement
+
+	.att_syntax prefix
+	movsd (%rsi), %ss:(%rdi), %ss:(%rax)
-- 
2.39.2