Permalink
Browse files

x86: handle some AVX & segment-related instructions properly. this fi…

…xes a segfault reported by @revskills
  • Loading branch information...
1 parent 7ed1988 commit 6b88d1d51eadf7175a8f8a11b690684443b11359 @aquynh committed Apr 19, 2016
Showing with 8 additions and 4 deletions.
  1. +8 −4 arch/X86/X86DisassemblerDecoder.c
@@ -1708,8 +1708,8 @@ static int readModRM(struct InternalInstruction *insn)
} \
switch (type) { \
default: \
- *valid = 0; \
- return 0; \
+ *valid = 0; \
+ return 0; \
case TYPE_Rv: \
return (uint8_t)(base + index); \
case TYPE_R8: \
@@ -1737,20 +1737,24 @@ static int readModRM(struct InternalInstruction *insn)
case TYPE_VK1: \
case TYPE_VK8: \
case TYPE_VK16: \
+ if (index > 7) \
+ *valid = 0; \
return prefix##_K0 + index; \
case TYPE_MM64: \
case TYPE_MM32: \
case TYPE_MM: \
return prefix##_MM0 + (index & 7); \
case TYPE_SEGMENTREG: \
- return prefix##_ES + (index & 7); \
+ if (index > 5) \
+ *valid = 0; \
+ return prefix##_ES + index; \
case TYPE_DEBUGREG: \
if (index > 7) \
*valid = 0; \
return prefix##_DR0 + index; \
case TYPE_CONTROLREG: \
return prefix##_CR0 + index; \
- } \
+ } \
}
/*

2 comments on commit 6b88d1d

@revskills

MITRE assigned CVE-2016-4044 to this issue

@aquynh
Owner
aquynh commented on 6b88d1d Apr 20, 2016

thanks for doing all these works!

Please sign in to comment.