summaryrefslogtreecommitdiffstats
path: root/target-i386
diff options
context:
space:
mode:
authorAndi Kleen <andi@firstfloor.org>2010-06-27 00:06:11 +0200
committerAurelien Jarno <aurelien@aurel32.net>2010-07-02 01:53:37 +0200
commitc045af25a52e9aa69c96bf8af4e4c639f657b08f (patch)
treeba4deb337f10fdd5832e317b5f7090df259995ef /target-i386
parent4c4fd3f852dbb3a7dbcc59110d03d3d15ada5f72 (diff)
downloadhqemu-c045af25a52e9aa69c96bf8af4e4c639f657b08f.zip
hqemu-c045af25a52e9aa69c96bf8af4e4c639f657b08f.tar.gz
Add more boundary checking to sse3/4 parsing
ssse3 uses tables with only two entries per op, but it is indexed with b1 which can contain variables upto 3. This happens when ssse3 or sse4 are used with REP* prefixes. Add boundary checking for this case. Signed-off-by: Andi Kleen <ak@linux.intel.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Diffstat (limited to 'target-i386')
-rw-r--r--target-i386/translate.c9
1 files changed, 9 insertions, 0 deletions
diff --git a/target-i386/translate.c b/target-i386/translate.c
index 8cb5cf0..2fcc026 100644
--- a/target-i386/translate.c
+++ b/target-i386/translate.c
@@ -3472,6 +3472,9 @@ static void gen_sse(DisasContext *s, int b, target_ulong pc_start, int rex_r)
case 0x171: /* shift xmm, im */
case 0x172:
case 0x173:
+ if (b1 >= 2) {
+ goto illegal_op;
+ }
val = ldub_code(s->pc++);
if (is_xmm) {
gen_op_movl_T0_im(val);
@@ -3699,6 +3702,9 @@ static void gen_sse(DisasContext *s, int b, target_ulong pc_start, int rex_r)
rm = modrm & 7;
reg = ((modrm >> 3) & 7) | rex_r;
mod = (modrm >> 6) & 3;
+ if (b1 >= 2) {
+ goto illegal_op;
+ }
sse_op2 = sse_op_table6[b].op[b1];
if (!sse_op2)
@@ -3798,6 +3804,9 @@ static void gen_sse(DisasContext *s, int b, target_ulong pc_start, int rex_r)
rm = modrm & 7;
reg = ((modrm >> 3) & 7) | rex_r;
mod = (modrm >> 6) & 3;
+ if (b1 >= 2) {
+ goto illegal_op;
+ }
sse_op2 = sse_op_table7[b].op[b1];
if (!sse_op2)
OpenPOWER on IntegriCloud