Uninitialized variable read in cgen disassembler
Alan Modra <[email protected]> Sat, 8 Feb 2020 00:31:21 +1030
| Newsgroups | gmane.comp.tools.cgen.devel |
|---|---|
| Message-ID | <[email protected]> |
I noticed this today in opcodes/m32c-ibld.c line 2498
case M32C_OPERAND_IMM_40_SI :
{
{
long value;
length = extract_normal (cd, ex_info, insn_value, 0, 32, 8, 24, 32, total_length, pc, & value);
value = ((((((((USI) (value) >> (16))) & (255))) | (((value) & (65280))))) | (((((value) << (16))) & (16711680))));
fields->f_dsp_40_u24 = value;
}
if (length <= 0) break;
length = extract_normal (cd, ex_info, insn_value, 0, 64, 0, 8, 32, total_length, pc, & fields->f_dsp_64_u8);
if (length <= 0) break;
{
FLD (f_dsp_40_s32) = ((((FLD (f_dsp_40_u24)) & (16777215))) | (((((FLD (f_dsp_64_u8)) << (24))) & (0xff000000))));
}
}
break;
Oops, the first "length <= 0" check on the return value of
extract_normal is *after* we've already used "value".
There's a return path in extract_normal that doesn't set *valuep,
when fill_cache fails.
--
Alan Modra
Australia Development Lab, IBM