Add more boundary checking to sse3/4 parsing
ssse3 uses tables with only two entries per op, but it is indexed
with b1 which can contain variables upto 3. This happens when ssse3
or sse4 are used with REP* prefixes.
Add boundary checking for this case.
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
diff --git a/target-i386/translate.c b/target-i386/translate.c
index 8cb5cf0..2fcc026 100644
--- a/target-i386/translate.c
+++ b/target-i386/translate.c
@@ -3472,6 +3472,9 @@
case 0x171: /* shift xmm, im */
case 0x172:
case 0x173:
+ if (b1 >= 2) {
+ goto illegal_op;
+ }
val = ldub_code(s->pc++);
if (is_xmm) {
gen_op_movl_T0_im(val);
@@ -3699,6 +3702,9 @@
rm = modrm & 7;
reg = ((modrm >> 3) & 7) | rex_r;
mod = (modrm >> 6) & 3;
+ if (b1 >= 2) {
+ goto illegal_op;
+ }
sse_op2 = sse_op_table6[b].op[b1];
if (!sse_op2)
@@ -3798,6 +3804,9 @@
rm = modrm & 7;
reg = ((modrm >> 3) & 7) | rex_r;
mod = (modrm >> 6) & 3;
+ if (b1 >= 2) {
+ goto illegal_op;
+ }
sse_op2 = sse_op_table7[b].op[b1];
if (!sse_op2)
