Fix OOB read and wries (#2273)

* Fix OOB read due to wrong macro in use. * Fix OOB write for regs_write and replace hardcoded values.
capstone-engine · Feb 18, 2024 · 34a1e01 · 34a1e01
1 parent 336171c
commit 34a1e01
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 6 deletions.
diff --git a/Mapping.c b/Mapping.c
@@ -95,7 +95,7 @@ void map_add_implicit_read(MCInst *MI, uint32_t Reg)
 		return;
 
 	uint16_t *regs_read = MI->flat_insn->detail->regs_read;
-	for (int i = 0; i < MAX_IMPL_W_REGS; ++i) {
+	for (int i = 0; i < MAX_IMPL_R_REGS; ++i) {
 		if (i == MI->flat_insn->detail->regs_read_count) {
 			regs_read[i] = Reg;
 			MI->flat_insn->detail->regs_read_count++;

diff --git a/arch/M68K/M68KDisassembler.h b/arch/M68K/M68KDisassembler.h
@@ -17,11 +17,11 @@ typedef struct m68k_info {
 	unsigned int type;
 	unsigned int address_mask; /* Address mask to simulate address lines */
 	cs_m68k extension;
-	uint16_t regs_read[20]; // list of implicit registers read by this insn
+	uint16_t regs_read[MAX_IMPL_R_REGS]; // list of implicit registers read by this insn
 	uint8_t regs_read_count; // number of implicit registers read by this insn
-	uint16_t regs_write[20]; // list of implicit registers modified by this insn
+	uint16_t regs_write[MAX_IMPL_W_REGS]; // list of implicit registers modified by this insn
 	uint8_t regs_write_count; // number of implicit registers modified by this insn
-	uint8_t groups[8];
+	uint8_t groups[MAX_NUM_GROUPS];
 	uint8_t groups_count;
 } m68k_info;
 

diff --git a/arch/M68K/M68KInstPrinter.c b/arch/M68K/M68KInstPrinter.c
@@ -276,10 +276,10 @@ void M68K_printInst(MCInst* MI, SStream* O, void* PrinterInfo)
 
 		memcpy(&detail->m68k, ext, sizeof(cs_m68k));
 
-		memcpy(&detail->regs_read, &info->regs_read, regs_read_count * sizeof(uint16_t));
+		memcpy(&detail->regs_read, &info->regs_read, regs_read_count * sizeof(info->regs_read[0]));
 		detail->regs_read_count = regs_read_count;
 
-		memcpy(&detail->regs_write, &info->regs_write, regs_write_count * sizeof(uint16_t));
+		memcpy(&detail->regs_write, &info->regs_write, regs_write_count * sizeof(info->regs_write[0]));
 		detail->regs_write_count = regs_write_count;
 
 		memcpy(&detail->groups, &info->groups, groups_count);