From 34e5885050fba3e2026efb385b449d04d9b52b7f Mon Sep 17 00:00:00 2001 From: Julian Seward Date: Tue, 9 Dec 2014 21:01:28 +0000 Subject: [PATCH] Fix incorrect implementation of AESKEYGENASSIST in the case where the two registers are the same. Fixes #341698. git-svn-id: svn://svn.valgrind.org/vex/trunk@3036 --- VEX/priv/guest_amd64_helpers.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/VEX/priv/guest_amd64_helpers.c b/VEX/priv/guest_amd64_helpers.c index ddcccafd5e..629e11a2b1 100644 --- a/VEX/priv/guest_amd64_helpers.c +++ b/VEX/priv/guest_amd64_helpers.c @@ -3845,10 +3845,19 @@ extern void amd64g_dirtyhelper_AESKEYGENASSIST ( V128* argL = (V128*)( ((UChar*)gst) + gstOffL ); V128* argR = (V128*)( ((UChar*)gst) + gstOffR ); - argR->w32[3] = RotWord (SubWord (argL->w32[3])) ^ imm8; - argR->w32[2] = SubWord (argL->w32[3]); - argR->w32[1] = RotWord (SubWord (argL->w32[1])) ^ imm8; - argR->w32[0] = SubWord (argL->w32[1]); + // We have to create the result in a temporary in the + // case where the src and dst regs are the same. See #341698. + V128 tmp; + + tmp.w32[3] = RotWord (SubWord (argL->w32[3])) ^ imm8; + tmp.w32[2] = SubWord (argL->w32[3]); + tmp.w32[1] = RotWord (SubWord (argL->w32[1])) ^ imm8; + tmp.w32[0] = SubWord (argL->w32[1]); + + argR->w32[3] = tmp.w32[3]; + argR->w32[2] = tmp.w32[2]; + argR->w32[1] = tmp.w32[1]; + argR->w32[0] = tmp.w32[0]; } -- 2.47.2