x86-64 Pjmptbl: normalize the argument before indexing into the jump table - #595
Open
xavierleroy wants to merge 3 commits into
Open
x86-64 Pjmptbl: normalize the argument before indexing into the jump table#595xavierleroy wants to merge 3 commits into
Pjmptbl: normalize the argument before indexing into the jump table#595xavierleroy wants to merge 3 commits into
Conversation
…p table The index argument of Pjmptbl is an unsigned 32-bit integer, not a 64-bit integer, so it must be converted to 64 bits (by zeroing the top 32 bits) before it can be used as an index into the jump table.
…mp table The index argument of Pbtbl is an unsigned 32-bit integer. However, RV64 stores it sign-extended in a 64-bit register. This can cause an incorrect access in the jump table in the unlikely case where the jump table has 2^31 entries or more. This commit uses two shifts instead of one so as to zero-extend the index while multiplying it by 4.
Contributor
Author
|
It turns out that RISC-V 64 bits has a similar issue, although much less serious: the 32-bit index argument is implicitly extended to a signed 64-bit integer. So, in the unlikely case where the jump table has more than 2^31 entries, we're addressing the wrong entry. Commit bc5a65f proposes to fix this by zero-extending the index while multiplying it by 4. It adds one shift-right instruction to the code generated for |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The index argument of
Pjmptblis an unsigned 32-bit integer, not a 64-bit integer, so it must be converted to 64 bits (by zeroing the top 32 bits) before being used as an index into the jump table.Issue reported by Christos Papakonstantinou (Cantina Security).