Skip to content

Commit b1caec7

Browse files
eliotmirandaeliotmiranda
committed
CogVM source as per VMMaker.oscog-eem.2445
BitBlt plugin copyBits. Fix degenerate calculations of preload and skew (i.e. a preload that sets notSkewMask to all ones and skewMask to zero, and there-by fix accessing the word beyond the end of a bitmap. If using external forms such access can crash the VM by trying to access a word that is not in memory (e.g. in an unmapped page). N.B. when preload is true, notSkewMask is all ones and skewMask is zero this extra word is read but discarded. Clean up primitiveCopyBits & primitiveWarpBits to use the more modern (and simpler) methodReturnReceiver style.
1 parent 01cdaff commit b1caec7

File tree

1 file changed

+73
-67
lines changed

1 file changed

+73
-67
lines changed

‎src/plugins/BitBltPlugin/BitBltPlugin.c‎

Lines changed: 73 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
/* Automatically generated by
2-
SmartSyntaxPluginCodeGenerator VMMaker.oscog-eem.2420 uuid: f303796f-283f-4d4c-a910-bf205a0b4600
2+
SmartSyntaxPluginCodeGenerator VMMaker.oscog-eem.2445 uuid: ecf80f10-9e24-4ff5-8a41-d65cb2690c94
33
from
4-
BitBltSimulation VMMaker.oscog-eem.2420 uuid: f303796f-283f-4d4c-a910-bf205a0b4600
4+
BitBltSimulation VMMaker.oscog-eem.2445 uuid: ecf80f10-9e24-4ff5-8a41-d65cb2690c94
55
*/
6-
static char __buildInfo[] = "BitBltSimulation VMMaker.oscog-eem.2420 uuid: f303796f-283f-4d4c-a910-bf205a0b4600 " __DATE__ ;
6+
static char __buildInfo[] = "BitBltSimulation VMMaker.oscog-eem.2445 uuid: ecf80f10-9e24-4ff5-8a41-d65cb2690c94 " __DATE__ ;
77

88

99

@@ -288,6 +288,8 @@ static sqInt (*isPointers)(sqInt oop);
288288
static sqInt (*isWords)(sqInt oop);
289289
static sqInt (*isWordsOrBytes)(sqInt oop);
290290
static sqInt (*methodArgumentCount)(void);
291+
static sqInt (*methodReturnInteger)(sqInt integer);
292+
static sqInt (*methodReturnReceiver)(void);
291293
static sqInt (*nilObject)(void);
292294
static sqInt (*pop)(sqInt nItems);
293295
static sqInt (*popthenPush)(sqInt nItems, sqInt oop);
@@ -296,7 +298,6 @@ static usqInt (*positive32BitValueOf)(sqInt oop);
296298
static usqLong (*positive64BitValueOf)(sqInt oop);
297299
static sqInt (*primitiveFail)(void);
298300
static sqInt (*primitiveFailFor)(sqInt reasonCode);
299-
static sqInt (*pushInteger)(sqInt integerValue);
300301
static sqInt (*showDisplayBitsLeftTopRightBottom)(sqInt aForm, sqInt l, sqInt t, sqInt r, sqInt b);
301302
static sqInt (*slotSizeOf)(sqInt oop);
302303
static sqInt (*stackIntegerValue)(sqInt offset);
@@ -324,6 +325,8 @@ extern sqInt isPointers(sqInt oop);
324325
extern sqInt isWords(sqInt oop);
325326
extern sqInt isWordsOrBytes(sqInt oop);
326327
extern sqInt methodArgumentCount(void);
328+
extern sqInt methodReturnInteger(sqInt integer);
329+
extern sqInt methodReturnReceiver(void);
327330
extern sqInt nilObject(void);
328331
extern sqInt pop(sqInt nItems);
329332
extern sqInt popthenPush(sqInt nItems, sqInt oop);
@@ -332,7 +335,6 @@ extern usqInt positive32BitValueOf(sqInt oop);
332335
extern usqLong positive64BitValueOf(sqInt oop);
333336
extern sqInt primitiveFail(void);
334337
extern sqInt primitiveFailFor(sqInt reasonCode);
335-
extern sqInt pushInteger(sqInt integerValue);
336338
extern sqInt showDisplayBitsLeftTopRightBottom(sqInt aForm, sqInt l, sqInt t, sqInt r, sqInt b);
337339
extern sqInt slotSizeOf(sqInt oop);
338340
extern sqInt stackIntegerValue(sqInt offset);
@@ -353,9 +355,9 @@ static int maskTable[33] = {
353355
};
354356
static const char *moduleName =
355357
#ifdef SQUEAK_BUILTIN_PLUGIN
356-
"BitBltPlugin VMMaker.oscog-eem.2420 (i)"
358+
"BitBltPlugin VMMaker.oscog-eem.2445 (i)"
357359
#else
358-
"BitBltPlugin VMMaker.oscog-eem.2420 (e)"
360+
"BitBltPlugin VMMaker.oscog-eem.2445 (e)"
359361
#endif
360362
;
361363
static sqInt noHalftone;
@@ -1564,18 +1566,19 @@ copyBitsLockedAndClipped(void)
15641566
dWid = ((bbW < (dxLowBits + 1)) ? bbW : (dxLowBits + 1));
15651567
preload = ((sxLowBits - dWid) + 1) < 0;
15661568
}
1567-
if (sourceMSB) {
1568-
skew = (sxLowBits - dxLowBits) * destDepth;
1569-
}
1570-
else {
1571-
skew = (dxLowBits - sxLowBits) * destDepth;
1572-
}
1569+
1570+
/* -32..32 */
1571+
skew = ((sourceMSB
1572+
? sxLowBits - dxLowBits
1573+
: dxLowBits - sxLowBits)) * destDepth;
15731574
if (preload) {
1574-
if (skew < 0) {
1575-
skew += 32;
1575+
if (skew != 0) {
1576+
skew = (skew < 0
1577+
? skew + 32
1578+
: skew - 32);
15761579
}
1577-
else {
1578-
skew -= 32;
1580+
if (skew == 0) {
1581+
preload = 0;
15791582
}
15801583
}
15811584

@@ -1916,18 +1919,19 @@ copyBitsFallback(operation_t *op, unsigned int flags)
19161919
dWid = ((bbW < (dxLowBits + 1)) ? bbW : (dxLowBits + 1));
19171920
preload = ((sxLowBits - dWid) + 1) < 0;
19181921
}
1919-
if (sourceMSB) {
1920-
skew = (sxLowBits - dxLowBits) * destDepth;
1921-
}
1922-
else {
1923-
skew = (dxLowBits - sxLowBits) * destDepth;
1924-
}
1922+
1923+
/* -32..32 */
1924+
skew = ((sourceMSB
1925+
? sxLowBits - dxLowBits
1926+
: dxLowBits - sxLowBits)) * destDepth;
19251927
if (preload) {
1926-
if (skew < 0) {
1927-
skew += 32;
1928+
if (skew != 0) {
1929+
skew = (skew < 0
1930+
? skew + 32
1931+
: skew - 32);
19281932
}
1929-
else {
1930-
skew -= 32;
1933+
if (skew == 0) {
1934+
preload = 0;
19311935
}
19321936
}
19331937

@@ -1972,25 +1976,22 @@ copyLoop(void)
19721976
mergeFnwith = ((unsigned int (*)(unsigned int, unsigned int)) (opTable[combinationRule + 1]));
19731977

19741978
/* Byte delta */
1975-
/* degenerate skew fixed for Sparc. 10/20/96 ikp */
1979+
/* degenerate skew fixed in sourceSkewAndPointerInit, eem 9/28/2018 */
19761980
hInc = hDir * 4;
1977-
if (skew == -32) {
1978-
skew = (unskew = (skewMask = 0));
1981+
assert((skew > -32)
1982+
&& (skew < 32));
1983+
if (skew < 0) {
1984+
unskew = skew + 32;
1985+
skewMask = ((usqInt)(AllOnes) << (0 - skew));
19791986
}
19801987
else {
1981-
if (skew < 0) {
1982-
unskew = skew + 32;
1983-
skewMask = ((usqInt)(AllOnes) << (0 - skew));
1988+
if (skew == 0) {
1989+
unskew = 0;
1990+
skewMask = AllOnes;
19841991
}
19851992
else {
1986-
if (skew == 0) {
1987-
unskew = 0;
1988-
skewMask = AllOnes;
1989-
}
1990-
else {
1991-
unskew = skew - 32;
1992-
skewMask = ((usqInt) AllOnes) >> skew;
1993-
}
1993+
unskew = skew - 32;
1994+
skewMask = ((usqInt) AllOnes) >> skew;
19941995
}
19951996
}
19961997
notSkewMask = (unsigned int)~skewMask;
@@ -4774,18 +4775,19 @@ performCopyLoop(void)
47744775
dWid = ((bbW < (dxLowBits + 1)) ? bbW : (dxLowBits + 1));
47754776
preload = ((sxLowBits - dWid) + 1) < 0;
47764777
}
4777-
if (sourceMSB) {
4778-
skew = (sxLowBits - dxLowBits) * destDepth;
4779-
}
4780-
else {
4781-
skew = (dxLowBits - sxLowBits) * destDepth;
4782-
}
4778+
4779+
/* -32..32 */
4780+
skew = ((sourceMSB
4781+
? sxLowBits - dxLowBits
4782+
: dxLowBits - sxLowBits)) * destDepth;
47834783
if (preload) {
4784-
if (skew < 0) {
4785-
skew += 32;
4784+
if (skew != 0) {
4785+
skew = (skew < 0
4786+
? skew + 32
4787+
: skew - 32);
47864788
}
4787-
else {
4788-
skew -= 32;
4789+
if (skew == 0) {
4790+
preload = 0;
47894791
}
47904792
}
47914793

@@ -5151,10 +5153,12 @@ primitiveCopyBits(void)
51515153
if (failed()) {
51525154
return null;
51535155
}
5154-
pop(methodArgumentCount());
5155-
if ((combinationRule == 22) || (combinationRule == 32)) {
5156-
pop(1);
5157-
return pushInteger(bitCount);
5156+
if ((combinationRule == 22)
5157+
|| (combinationRule == 32)) {
5158+
methodReturnInteger(bitCount);
5159+
}
5160+
else {
5161+
methodReturnReceiver();
51585162
}
51595163
return 0;
51605164
}
@@ -5675,7 +5679,7 @@ primitiveWarpBits(void)
56755679
if (failed()) {
56765680
return null;
56775681
}
5678-
pop(methodArgumentCount());
5682+
methodReturnReceiver();
56795683
return 0;
56805684
}
56815685

@@ -6642,6 +6646,8 @@ setInterpreter(struct VirtualMachine*anInterpreter)
66426646
isWords = interpreterProxy->isWords;
66436647
isWordsOrBytes = interpreterProxy->isWordsOrBytes;
66446648
methodArgumentCount = interpreterProxy->methodArgumentCount;
6649+
methodReturnInteger = interpreterProxy->methodReturnInteger;
6650+
methodReturnReceiver = interpreterProxy->methodReturnReceiver;
66456651
nilObject = interpreterProxy->nilObject;
66466652
pop = interpreterProxy->pop;
66476653
popthenPush = interpreterProxy->popthenPush;
@@ -6650,7 +6656,6 @@ setInterpreter(struct VirtualMachine*anInterpreter)
66506656
positive64BitValueOf = interpreterProxy->positive64BitValueOf;
66516657
primitiveFail = interpreterProxy->primitiveFail;
66526658
primitiveFailFor = interpreterProxy->primitiveFailFor;
6653-
pushInteger = interpreterProxy->pushInteger;
66546659
showDisplayBitsLeftTopRightBottom = interpreterProxy->showDisplayBitsLeftTopRightBottom;
66556660
slotSizeOf = interpreterProxy->slotSizeOf;
66566661
stackIntegerValue = interpreterProxy->stackIntegerValue;
@@ -6791,18 +6796,19 @@ sourceSkewAndPointerInit(void)
67916796
dWid = ((bbW < (dxLowBits + 1)) ? bbW : (dxLowBits + 1));
67926797
preload = ((sxLowBits - dWid) + 1) < 0;
67936798
}
6794-
if (sourceMSB) {
6795-
skew = (sxLowBits - dxLowBits) * destDepth;
6796-
}
6797-
else {
6798-
skew = (dxLowBits - sxLowBits) * destDepth;
6799-
}
6799+
6800+
/* -32..32 */
6801+
skew = ((sourceMSB
6802+
? sxLowBits - dxLowBits
6803+
: dxLowBits - sxLowBits)) * destDepth;
68006804
if (preload) {
6801-
if (skew < 0) {
6802-
skew += 32;
6805+
if (skew != 0) {
6806+
skew = (skew < 0
6807+
? skew + 32
6808+
: skew - 32);
68036809
}
6804-
else {
6805-
skew -= 32;
6810+
if (skew == 0) {
6811+
preload = 0;
68066812
}
68076813
}
68086814

0 commit comments

Comments
 (0)