From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from [140.186.70.92] (port=52824 helo=eggs.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1OSdVw-0002wl-Tf
	for qemu-devel@nongnu.org; Sat, 26 Jun 2010 18:06:18 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.69)
	(envelope-from <andi@firstfloor.org>) id 1OSdVv-00036j-Cr
	for qemu-devel@nongnu.org; Sat, 26 Jun 2010 18:06:16 -0400
Received: from one.firstfloor.org ([213.235.205.2]:52527)
	by eggs.gnu.org with esmtp (Exim 4.69)
	(envelope-from <andi@firstfloor.org>) id 1OSdVv-00036G-5A
	for qemu-devel@nongnu.org; Sat, 26 Jun 2010 18:06:15 -0400
Received: from basil.firstfloor.org (p5B3C8129.dip0.t-ipconnect.de
	[91.60.129.41])
	by one.firstfloor.org (Postfix) with ESMTP id 678E21A980C3
	for <qemu-devel@nongnu.org>; Sun, 27 Jun 2010 00:06:12 +0200 (CEST)
Date: Sun, 27 Jun 2010 00:06:11 +0200
From: Andi Kleen <andi@firstfloor.org>
Message-ID: <20100626220611.GA12521@basil.fritz.box>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Subject: [Qemu-devel] [PATCH] Add more boundary checking to sse3/4 parsing
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: qemu-devel@nongnu.org

Add more boundary checking to sse3/4 parsing

s?sse3 uses tables with only two entries per op, but it is indexed
with b1 which can contain variables upto 3. This happens when ssse3
or sse4 are used with REP* prefixes.

Add boundary checking for this case.

Signed-off-by: Andi Kleen <ak@linux.intel.com>

diff --git a/target-i386/translate.c b/target-i386/translate.c
index 1336d6f..aae0374 100644
--- a/target-i386/translate.c
+++ b/target-i386/translate.c
@@ -3472,6 +3472,8 @@ static void gen_sse(DisasContext *s, int b, target_ulong pc_start, int rex_r)
         case 0x171: /* shift xmm, im */
         case 0x172:
         case 0x173:
+            if (b1 >= 2)
+	        goto illegal_op;
             val = ldub_code(s->pc++);
             if (is_xmm) {
                 gen_op_movl_T0_im(val);
@@ -3699,6 +3701,8 @@ static void gen_sse(DisasContext *s, int b, target_ulong pc_start, int rex_r)
             rm = modrm & 7;
             reg = ((modrm >> 3) & 7) | rex_r;
             mod = (modrm >> 6) & 3;
+            if (b1 >= 2)
+                goto illegal_op;
 
             sse_op2 = sse_op_table6[b].op[b1];
             if (!sse_op2)
@@ -3798,6 +3802,8 @@ static void gen_sse(DisasContext *s, int b, target_ulong pc_start, int rex_r)
             rm = modrm & 7;
             reg = ((modrm >> 3) & 7) | rex_r;
             mod = (modrm >> 6) & 3;
+            if (b1 >= 2)
+                goto illegal_op;
 
             sse_op2 = sse_op_table7[b].op[b1];
             if (!sse_op2)