The first call of set_cc_op() in a new translation sequence
is done with old_op set to CC_OP_DYNAMIC (-1).
This will do an out of bound access to the array cc_op_live[].
We fix that by adding an entry in cc_op_live[] for CC_OP_DYNAMIC.
Reported-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <
20171221160558.14151-1-laurent@vivier.eu>
*/
typedef enum {
/* Translator only -- use env->cc_op. */
- CC_OP_DYNAMIC = -1,
+ CC_OP_DYNAMIC,
/* Each flag bit computed into cc_[xcnvz]. */
CC_OP_FLAGS,
#endif
static const uint8_t cc_op_live[CC_OP_NB] = {
+ [CC_OP_DYNAMIC] = CCF_C | CCF_V | CCF_Z | CCF_N | CCF_X,
[CC_OP_FLAGS] = CCF_C | CCF_V | CCF_Z | CCF_N | CCF_X,
[CC_OP_ADDB ... CC_OP_ADDL] = CCF_X | CCF_N | CCF_V,
[CC_OP_SUBB ... CC_OP_SUBL] = CCF_X | CCF_N | CCF_V,