Skip to content

Commit 0d0f743

Browse files
committed
target/riscv: fix ub during instruction decode
A left shift operation caused an implicit integer promotion, triggering the following UBSan error: ``` left shift of 254 by 24 places cannot be represented in type 'int' ``` NOTE: it seems that this code won't work correctly with BE targets, however this is a general problem of the whole implementation anyway. Signed-off-by: Anatoly Parshintsev <[email protected]>
1 parent 608ba43 commit 0d0f743

File tree

1 file changed

+3
-9
lines changed

1 file changed

+3
-9
lines changed

src/target/riscv/riscv.c

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2370,23 +2370,17 @@ static int riscv_hit_watchpoint(struct target *target, struct watchpoint **hit_w
23702370
riscv_reg_t dpc;
23712371
if (riscv_reg_get(target, &dpc, GDB_REGNO_DPC) != ERROR_OK)
23722372
return ERROR_FAIL;
2373-
const uint8_t length = 4;
23742373
LOG_TARGET_DEBUG(target, "dpc is 0x%" PRIx64, dpc);
23752374

23762375
/* fetch the instruction at dpc */
2377-
uint8_t buffer[length];
2378-
if (target_read_buffer(target, dpc, length, buffer) != ERROR_OK) {
2376+
uint8_t buffer[4];
2377+
if (target_read_buffer(target, dpc, sizeof(buffer), buffer) != ERROR_OK) {
23792378
LOG_TARGET_ERROR(target, "Failed to read instruction at dpc 0x%" PRIx64,
23802379
dpc);
23812380
return ERROR_FAIL;
23822381
}
23832382

2384-
riscv_insn_t instruction = 0;
2385-
2386-
for (int i = 0; i < length; i++) {
2387-
LOG_TARGET_DEBUG(target, "Next byte is %x", buffer[i]);
2388-
instruction += (buffer[i] << 8 * i);
2389-
}
2383+
riscv_insn_t instruction = le_to_h_u32(buffer);
23902384
LOG_TARGET_DEBUG(target, "Full instruction is %x", instruction);
23912385

23922386
int rs;

0 commit comments

Comments
 (0)