commit db5fa770268baf8cc82cf9b141d69799fd485fe2
Author: Nick Clifton <nickc@redhat.com>
Date:   Wed Jun 14 13:35:06 2017 +0100

    Fix address violation problems when disassembling a corrupt RX binary.
    
    	PR binutils/21587
    	* rx-decode.opc: Include libiberty.h
    	(GET_SCALE): New macro - validates access to SCALE array.
    	(GET_PSCALE): New macro - validates access to PSCALE array.
    	(DIs, SIs, S2Is, rx_disp): Use new macros.
    	* rx-decode.c: Regenerate.

Upstream-Status: Backport

CVE: CVE-2017-9750
Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com>

Index: git/opcodes/rx-decode.c
===================================================================
--- git.orig/opcodes/rx-decode.c	2017-09-21 14:41:57.478649861 +0530
+++ git/opcodes/rx-decode.c	2017-09-21 14:41:57.458649736 +0530
@@ -27,6 +27,7 @@
 #include <string.h>
 #include "ansidecl.h"
 #include "opcode/rx.h"
+#include "libiberty.h"
 
 #define RX_OPCODE_BIG_ENDIAN 0
 
@@ -45,7 +46,7 @@
 #define LSIZE 2
 
 /* These are for when the upper bits are "don't care" or "undefined".  */
-static int bwl[] =
+static int bwl[4] =
 {
   RX_Byte,
   RX_Word,
@@ -53,7 +54,7 @@
   RX_Bad_Size /* Bogus instructions can have a size field set to 3.  */
 };
 
-static int sbwl[] =
+static int sbwl[4] =
 {
   RX_SByte,
   RX_SWord,
@@ -61,7 +62,7 @@
   RX_Bad_Size /* Bogus instructions can have a size field set to 3.  */
 };
 
-static int ubw[] =
+static int ubw[4] =
 {
   RX_UByte,
   RX_UWord,
@@ -69,7 +70,7 @@
   RX_Bad_Size /* Bogus instructions can have a size field set to 3.  */
 };
 
-static int memex[] =
+static int memex[4] =
 {
   RX_SByte,
   RX_SWord,
@@ -89,6 +90,9 @@
 /* This is for the prefix size enum.  */
 static int PSCALE[] = { 4, 1, 1, 1, 2, 2, 2, 3, 4 };
 
+#define GET_SCALE(_indx)  ((unsigned)(_indx) < ARRAY_SIZE (SCALE) ? SCALE[(_indx)] : 0)
+#define GET_PSCALE(_indx) ((unsigned)(_indx) < ARRAY_SIZE (PSCALE) ? PSCALE[(_indx)] : 0)
+
 static int flagmap[] = {0, 1, 2, 3, 0, 0, 0, 0,
 		       16, 17, 0, 0, 0, 0, 0, 0 };
 
@@ -107,7 +111,7 @@
 #define DC(c)       OP (0, RX_Operand_Immediate, 0, c)
 #define DR(r)       OP (0, RX_Operand_Register,  r, 0)
 #define DI(r,a)     OP (0, RX_Operand_Indirect,  r, a)
-#define DIs(r,a,s)  OP (0, RX_Operand_Indirect,  r, (a) * SCALE[s])
+#define DIs(r,a,s)  OP (0, RX_Operand_Indirect,  r, (a) * GET_SCALE (s))
 #define DD(t,r,s)   rx_disp (0, t, r, bwl[s], ld);
 #define DF(r)       OP (0, RX_Operand_Flag,  flagmap[r], 0)
 
@@ -115,7 +119,7 @@
 #define SR(r)       OP (1, RX_Operand_Register,  r, 0)
 #define SRR(r)      OP (1, RX_Operand_TwoReg,  r, 0)
 #define SI(r,a)     OP (1, RX_Operand_Indirect,  r, a)
-#define SIs(r,a,s)  OP (1, RX_Operand_Indirect,  r, (a) * SCALE[s])
+#define SIs(r,a,s)  OP (1, RX_Operand_Indirect,  r, (a) * GET_SCALE (s))
 #define SD(t,r,s)   rx_disp (1, t, r, bwl[s], ld);
 #define SP(t,r)     rx_disp (1, t, r, (t!=3) ? RX_UByte : RX_Long, ld); P(t, 1);
 #define SPm(t,r,m)  rx_disp (1, t, r, memex[m], ld); rx->op[1].size = memex[m];
@@ -124,7 +128,7 @@
 #define S2C(i)      OP (2, RX_Operand_Immediate, 0, i)
 #define S2R(r)      OP (2, RX_Operand_Register,  r, 0)
 #define S2I(r,a)    OP (2, RX_Operand_Indirect,  r, a)
-#define S2Is(r,a,s) OP (2, RX_Operand_Indirect,  r, (a) * SCALE[s])
+#define S2Is(r,a,s) OP (2, RX_Operand_Indirect,  r, (a) * GET_SCALE (s))
 #define S2D(t,r,s)  rx_disp (2, t, r, bwl[s], ld);
 #define S2P(t,r)    rx_disp (2, t, r, (t!=3) ? RX_UByte : RX_Long, ld); P(t, 2);
 #define S2Pm(t,r,m) rx_disp (2, t, r, memex[m], ld); rx->op[2].size = memex[m];
@@ -211,7 +215,7 @@
 }
 
 static void
-rx_disp (int n, int type, int reg, int size, LocalData * ld)
+rx_disp (int n, int type, int reg, unsigned int size, LocalData * ld)
 {
   int disp;
 
@@ -228,7 +232,7 @@
     case 1:
       ld->rx->op[n].type = RX_Operand_Indirect;
       disp = GETBYTE ();
-      ld->rx->op[n].addend = disp * PSCALE[size];
+      ld->rx->op[n].addend = disp * GET_PSCALE (size);
       break;
     case 2:
       ld->rx->op[n].type = RX_Operand_Indirect;
@@ -238,7 +242,7 @@
 #else
       disp = disp + GETBYTE () * 256;
 #endif
-      ld->rx->op[n].addend = disp * PSCALE[size];
+      ld->rx->op[n].addend = disp * GET_PSCALE (size);
       break;
     default:
       abort ();
Index: git/opcodes/rx-decode.opc
===================================================================
--- git.orig/opcodes/rx-decode.opc	2017-09-21 14:41:57.478649861 +0530
+++ git/opcodes/rx-decode.opc	2017-09-21 14:41:57.458649736 +0530
@@ -26,6 +26,7 @@
 #include <string.h>
 #include "ansidecl.h"
 #include "opcode/rx.h"
+#include "libiberty.h"
 
 #define RX_OPCODE_BIG_ENDIAN 0
 
@@ -44,7 +45,7 @@
 #define LSIZE 2
 
 /* These are for when the upper bits are "don't care" or "undefined".  */
-static int bwl[] =
+static int bwl[4] =
 {
   RX_Byte,
   RX_Word,
@@ -52,7 +53,7 @@
   RX_Bad_Size /* Bogus instructions can have a size field set to 3.  */
 };
 
-static int sbwl[] =
+static int sbwl[4] =
 {
   RX_SByte,
   RX_SWord,
@@ -60,7 +61,7 @@
   RX_Bad_Size /* Bogus instructions can have a size field set to 3.  */
 };
 
-static int ubw[] =
+static int ubw[4] =
 {
   RX_UByte,
   RX_UWord,
@@ -68,7 +69,7 @@
   RX_Bad_Size /* Bogus instructions can have a size field set to 3.  */
 };
 
-static int memex[] =
+static int memex[4] =
 {
   RX_SByte,
   RX_SWord,
@@ -88,6 +89,9 @@
 /* This is for the prefix size enum.  */
 static int PSCALE[] = { 4, 1, 1, 1, 2, 2, 2, 3, 4 };
 
+#define GET_SCALE(_indx)  ((unsigned)(_indx) < ARRAY_SIZE (SCALE) ? SCALE[(_indx)] : 0)
+#define GET_PSCALE(_indx) ((unsigned)(_indx) < ARRAY_SIZE (PSCALE) ? PSCALE[(_indx)] : 0)
+
 static int flagmap[] = {0, 1, 2, 3, 0, 0, 0, 0,
 		       16, 17, 0, 0, 0, 0, 0, 0 };
 
@@ -106,7 +110,7 @@
 #define DC(c)       OP (0, RX_Operand_Immediate, 0, c)
 #define DR(r)       OP (0, RX_Operand_Register,  r, 0)
 #define DI(r,a)     OP (0, RX_Operand_Indirect,  r, a)
-#define DIs(r,a,s)  OP (0, RX_Operand_Indirect,  r, (a) * SCALE[s])
+#define DIs(r,a,s)  OP (0, RX_Operand_Indirect,  r, (a) * GET_SCALE (s))
 #define DD(t,r,s)   rx_disp (0, t, r, bwl[s], ld);
 #define DF(r)       OP (0, RX_Operand_Flag,  flagmap[r], 0)
 
@@ -114,7 +118,7 @@
 #define SR(r)       OP (1, RX_Operand_Register,  r, 0)
 #define SRR(r)      OP (1, RX_Operand_TwoReg,  r, 0)
 #define SI(r,a)     OP (1, RX_Operand_Indirect,  r, a)
-#define SIs(r,a,s)  OP (1, RX_Operand_Indirect,  r, (a) * SCALE[s])
+#define SIs(r,a,s)  OP (1, RX_Operand_Indirect,  r, (a) * GET_SCALE (s))
 #define SD(t,r,s)   rx_disp (1, t, r, bwl[s], ld);
 #define SP(t,r)     rx_disp (1, t, r, (t!=3) ? RX_UByte : RX_Long, ld); P(t, 1);
 #define SPm(t,r,m)  rx_disp (1, t, r, memex[m], ld); rx->op[1].size = memex[m];
@@ -123,7 +127,7 @@
 #define S2C(i)      OP (2, RX_Operand_Immediate, 0, i)
 #define S2R(r)      OP (2, RX_Operand_Register,  r, 0)
 #define S2I(r,a)    OP (2, RX_Operand_Indirect,  r, a)
-#define S2Is(r,a,s) OP (2, RX_Operand_Indirect,  r, (a) * SCALE[s])
+#define S2Is(r,a,s) OP (2, RX_Operand_Indirect,  r, (a) * GET_SCALE (s))
 #define S2D(t,r,s)  rx_disp (2, t, r, bwl[s], ld);
 #define S2P(t,r)    rx_disp (2, t, r, (t!=3) ? RX_UByte : RX_Long, ld); P(t, 2);
 #define S2Pm(t,r,m) rx_disp (2, t, r, memex[m], ld); rx->op[2].size = memex[m];
@@ -210,7 +214,7 @@
 }
 
 static void
-rx_disp (int n, int type, int reg, int size, LocalData * ld)
+rx_disp (int n, int type, int reg, unsigned int size, LocalData * ld)
 {
   int disp;
 
@@ -227,7 +231,7 @@
     case 1:
       ld->rx->op[n].type = RX_Operand_Indirect;
       disp = GETBYTE ();
-      ld->rx->op[n].addend = disp * PSCALE[size];
+      ld->rx->op[n].addend = disp * GET_PSCALE (size);
       break;
     case 2:
       ld->rx->op[n].type = RX_Operand_Indirect;
@@ -237,7 +241,7 @@
 #else
       disp = disp + GETBYTE () * 256;
 #endif
-      ld->rx->op[n].addend = disp * PSCALE[size];
+      ld->rx->op[n].addend = disp * GET_PSCALE (size);
       break;
     default:
       abort ();
Index: git/opcodes/ChangeLog
===================================================================
--- git.orig/opcodes/ChangeLog	2017-09-21 14:40:17.000000000 +0530
+++ git/opcodes/ChangeLog	2017-09-21 14:44:07.503461009 +0530
@@ -15,6 +15,15 @@
 	array.
 	* rl78-decode.c: Regenerate.
 
+2017-06-14  Nick Clifton  <nickc@redhat.com>
+
+	PR binutils/21587
+	* rx-decode.opc: Include libiberty.h
+	(GET_SCALE): New macro - validates access to SCALE array.
+	(GET_PSCALE): New macro - validates access to PSCALE array.
+	(DIs, SIs, S2Is, rx_disp): Use new macros.
+	* rx-decode.c: Regenerate.
+
 2016-08-03  Tristan Gingold  <gingold@adacore.com>
 
 	* configure: Regenerate.
