Skip to content

Commit 02641a3

Browse files
committed
assemble: process_ea - fix unitialized read
In commit 2469b8b we occasionally bring the ability to read unitialized memory due to refactoring. Fix it doing needed test inside the function and setting up an error message if needed. Side note: passing 7 arguments into the function means we have to decompose this helper somehow, such number of arguments is a way over the top. Bugzilla: https://bugzilla.nasm.us/show_bug.cgi?id=3392751 Reported-by: Marco <mvanotti@protonmail.com> Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
1 parent 2469b8b commit 02641a3

File tree

1 file changed

+21
-10
lines changed

1 file changed

+21
-10
lines changed

asm/assemble.c

Lines changed: 21 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -245,8 +245,8 @@ static int op_rexflags(const operand *, int);
245245
static int op_evexflags(const operand *, int, uint8_t);
246246
static void add_asp(insn *, int);
247247

248-
static enum ea_type process_ea(operand *, ea *, int, int,
249-
opflags_t, insn *, const char **);
248+
static int process_ea(operand *, ea *, int, int, opflags_t,
249+
insn *, enum ea_type, const char **);
250250

251251
static inline bool absolute_op(const struct operand *o)
252252
{
@@ -1615,7 +1615,7 @@ static int64_t calcsize(int32_t segment, int64_t offset, int bits,
16151615
opy->eaflags |= EAF_SIB;
16161616

16171617
if (process_ea(opy, &ea_data, bits,
1618-
rfield, rflags, ins, &errmsg) != eat) {
1618+
rfield, rflags, ins, eat, &errmsg)) {
16191619
nasm_nonfatal("%s", errmsg);
16201620
return -1;
16211621
} else {
@@ -2261,7 +2261,7 @@ static void gencode(struct out_data *data, insn *ins)
22612261
}
22622262

22632263
if (process_ea(opy, &ea_data, bits,
2264-
rfield, rflags, ins, &errmsg) != eat)
2264+
rfield, rflags, ins, eat, &errmsg))
22652265
nasm_nonfatal("%s", errmsg);
22662266

22672267
p = bytes;
@@ -2781,9 +2781,9 @@ static enum match_result matches(const struct itemplate *itemp,
27812781
input->eaflags & EAF_BYTEOFFS || (o >= -128 && \
27822782
o <= 127 && seg == NO_SEG && !forw_ref)))
27832783

2784-
static enum ea_type process_ea(operand *input, ea *output, int bits,
2785-
int rfield, opflags_t rflags, insn *ins,
2786-
const char **errmsgp)
2784+
static int process_ea(operand *input, ea *output, int bits,
2785+
int rfield, opflags_t rflags, insn *ins,
2786+
enum ea_type expected, const char **errmsgp)
27872787
{
27882788
bool forw_ref = !!(input->opflags & OPFLAG_UNKNOWN);
27892789
int addrbits = ins->addr_size;
@@ -3241,9 +3241,16 @@ static enum ea_type process_ea(operand *input, ea *output, int bits,
32413241
}
32423242

32433243
output->size = 1 + output->sib_present + output->bytes;
3244-
return output->type;
3244+
/*
3245+
* The type parsed might not match one supplied by
3246+
* a caller. In this case exit with error and let
3247+
* the caller to deside how critical it is.
3248+
*/
3249+
if (output->type != expected)
3250+
goto err_set_msg;
3251+
return 0;
32453252

3246-
err:
3253+
err_set_msg:
32473254
if (!errmsg) {
32483255
/* Default error message */
32493256
static char invalid_address_msg[40];
@@ -3252,7 +3259,11 @@ static enum ea_type process_ea(operand *input, ea *output, int bits,
32523259
errmsg = invalid_address_msg;
32533260
}
32543261
*errmsgp = errmsg;
3255-
return output->type = EA_INVALID;
3262+
return -1;
3263+
3264+
err:
3265+
output->type = EA_INVALID;
3266+
goto err_set_msg;
32563267
}
32573268

32583269
static void add_asp(insn *ins, int addrbits)

0 commit comments

Comments
 (0)