diff mbox series

asan: index out of bounds in print_insn_tic6x

Message ID akD5h_0re39tyi5-@squeak.grove.modra.org
State New
Headers
Series asan: index out of bounds in print_insn_tic6x |

Checks

Context Check Description
linaro-tcwg-bot/tcwg_binutils_build--master-aarch64 fail Patch failed to apply
linaro-tcwg-bot/tcwg_binutils_build--master-arm fail Patch failed to apply

Commit Message

Alan Modra June 28, 2026, 10:37 a.m. UTC 
  header.word_compact is a seven element array.  If fp_offset has values
of 29 to 31 then word_compact[7] is read to set num_bits which is then
never used since the function returns before its first use.

	* tic6x-dis.c (print_insn_tic6x): Delay setting num_bits until
	invalid fp_offset values are handled.
diff mbox series

Patch

diff --git a/opcodes/tic6x-dis.c b/opcodes/tic6x-dis.c
index ca0156e21e3..eb9e1e340ea 100644
--- a/opcodes/tic6x-dis.c
+++ b/opcodes/tic6x-dis.c
@@ -264,21 +264,19 @@  print_insn_tic6x (bfd_vma addr, struct disassemble_info *info)
     {
       if (fp_offset & 0x1)
 	bad_offset = true;
-      if ((fp_offset & 0x3) && (fp_offset >= 28
-				|| !header.word_compact[fp_offset >> 2]))
+      else if ((fp_offset & 0x3) && (fp_offset >= 28
+				     || !header.word_compact[fp_offset >> 2]))
 	bad_offset = true;
-      if (fp_offset == 28)
+      else if (fp_offset == 28)
 	{
 	  info->bytes_per_chunk = 4;
 	  info->fprintf_func (info->stream, "<fetch packet header 0x%.8x>",
 			      header.header);
 	  return 4;
 	}
-      num_bits = (header.word_compact[fp_offset >> 2] ? 16 : 32);
     }
   else
     {
-      num_bits = 32;
       if (fp_offset & 0x3)
 	bad_offset = true;
     }
@@ -290,6 +288,10 @@  print_insn_tic6x (bfd_vma addr, struct disassemble_info *info)
       return 1;
     }
 
+  num_bits = 32;
+  if (fetch_packet_header_based && header.word_compact[fp_offset >> 2])
+    num_bits = 16;
+
   if (num_bits == 16)
     {
       /* The least-significant part of a 32-bit word comes logically