From 33572269a54ba6339ce00537abfa434e4ffc95c2 Mon Sep 17 00:00:00 2001 From: "Emilio G. Cota" Date: Tue, 10 Apr 2018 11:11:04 -0400 Subject: target/riscv: avoid integer overflow in next_page PC check If the PC is in the last page of the address space, next_page_start overflows to 0. Fix it. Reported-by: Richard Henderson Suggested-by: Richard Henderson Reviewed-by: Richard Henderson Reviewed-by: Michael Clark Acked-by: Bastian Koppelmann Cc: Michael Clark Cc: Palmer Dabbelt Cc: Sagar Karandikar Cc: Bastian Koppelmann Signed-off-by: Emilio G. Cota Signed-off-by: Richard Henderson --- target/riscv/translate.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'target/riscv/translate.c') diff --git a/target/riscv/translate.c b/target/riscv/translate.c index c0e6a044d3..a98033ca77 100644 --- a/target/riscv/translate.c +++ b/target/riscv/translate.c @@ -1850,11 +1850,11 @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb) CPURISCVState *env = cs->env_ptr; DisasContext ctx; target_ulong pc_start; - target_ulong next_page_start; + target_ulong page_start; int num_insns; int max_insns; pc_start = tb->pc; - next_page_start = (pc_start & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE; + page_start = pc_start & TARGET_PAGE_MASK; ctx.pc = pc_start; /* once we have GDB, the rest of the translate.c implementation should be @@ -1904,7 +1904,7 @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb) if (cs->singlestep_enabled) { break; } - if (ctx.pc >= next_page_start) { + if (ctx.pc - page_start >= TARGET_PAGE_SIZE) { break; } if (tcg_op_buf_full()) { -- cgit v1.2.1