summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorEmilio G. Cota <cota@braap.org>2018-04-10 11:13:54 -0400
committerRichard Henderson <richard.henderson@linaro.org>2018-05-09 10:12:21 -0700
commit6cd79443d33e6ba6b4c5b787eb713ca1cec56328 (patch)
tree469a17801bb5ae04fe4903acaa6f00e5cdeb4e82
parent071bd2b628cedbb640be8ca6c25d1949b2e6fe4a (diff)
downloadqemu-6cd79443d33e6ba6b4c5b787eb713ca1cec56328.tar.gz
target/mips: avoid integer overflow in next_page PC check
If the PC is in the last page of the address space, next_page_start overflows to 0. Fix it. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Cc: Aurelien Jarno <aurelien@aurel32.net> Cc: Yongbok Kim <yongbok.kim@mips.com> Signed-off-by: Emilio G. Cota <cota@braap.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-rw-r--r--target/mips/translate.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/target/mips/translate.c b/target/mips/translate.c
index d05ee67e63..d8e717dacf 100644
--- a/target/mips/translate.c
+++ b/target/mips/translate.c
@@ -20202,14 +20202,14 @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
CPUMIPSState *env = cs->env_ptr;
DisasContext ctx;
target_ulong pc_start;
- target_ulong next_page_start;
+ target_ulong page_start;
int num_insns;
int max_insns;
int insn_bytes;
int is_slot;
pc_start = tb->pc;
- next_page_start = (pc_start & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
+ page_start = pc_start & TARGET_PAGE_MASK;
ctx.pc = pc_start;
ctx.saved_pc = -1;
ctx.singlestep_enabled = cs->singlestep_enabled;
@@ -20320,7 +20320,7 @@ void gen_intermediate_code(CPUState *cs, struct TranslationBlock *tb)
break;
}
- if (ctx.pc >= next_page_start) {
+ if (ctx.pc - page_start >= TARGET_PAGE_SIZE) {
break;
}