]> www.infradead.org Git - users/dwmw2/qemu.git/commit
target/arm: Avoid shifts by -1 in tszimm_shr() and tszimm_shl()
authorPeter Maydell <peter.maydell@linaro.org>
Mon, 22 Jul 2024 17:29:56 +0000 (18:29 +0100)
committerPeter Maydell <peter.maydell@linaro.org>
Mon, 29 Jul 2024 15:56:46 +0000 (16:56 +0100)
commit76916dfa89e8900639c1055c07a295c06628a0bc
tree55c2fd0278c0d14b9ccc9281854af96141fbc258
parentea3f5a90f036734522e9af3bffd77e69e9f47355
target/arm: Avoid shifts by -1 in tszimm_shr() and tszimm_shl()

The function tszimm_esz() returns a shift amount, or possibly -1 in
certain cases that correspond to unallocated encodings in the
instruction set.  We catch these later in the trans_ functions
(generally with an "a-esz < 0" check), but before we do the
decodetree-generated code will also call tszimm_shr() or tszimm_sl(),
which will use the tszimm_esz() return value as a shift count without
checking that it is not negative, which is undefined behaviour.

Avoid the UB by checking the return value in tszimm_shr() and
tszimm_shl().

Cc: qemu-stable@nongnu.org
Resolves: Coverity CID 15476171547694
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240722172957.1041231-4-peter.maydell@linaro.org
target/arm/tcg/translate-sve.c