From 728046289161efb28dce98c625e6400aabbbeba3 Mon Sep 17 00:00:00 2001 From: Syed Mohammed Nayyar Date: Sat, 4 Jul 2026 18:47:06 +0530 Subject: [PATCH 1/2] xtensa: fix swapped isIntN arguments in decodeOffset_16_16Operand --- arch/Xtensa/XtensaDisassembler.c | 2 +- tests/integration/test_poc.c | 21 +++++++++++++++++++++ 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/arch/Xtensa/XtensaDisassembler.c b/arch/Xtensa/XtensaDisassembler.c index 2c1e117f53..1f2c6d9fd7 100644 --- a/arch/Xtensa/XtensaDisassembler.c +++ b/arch/Xtensa/XtensaDisassembler.c @@ -788,7 +788,7 @@ static DecodeStatus decodeOffset_16_16Operand(MCInst *Inst, uint64_t Imm, int64_t Address, const void *Decoder) { - CS_ASSERT_RET_VAL(isIntN(Imm, 8) && "Invalid immediate", + CS_ASSERT_RET_VAL(isIntN(8, Imm) && "Invalid immediate", MCDisassembler_Fail); if ((Imm & 0xf) != 0) MCOperand_CreateImm0(Inst, (Imm << 4)); diff --git a/tests/integration/test_poc.c b/tests/integration/test_poc.c index f461de4f47..b9fff3f6ea 100644 --- a/tests/integration/test_poc.c +++ b/tests/integration/test_poc.c @@ -130,12 +130,33 @@ static void test_ub_shift_sh_dsp_p(void) return; } +/// Swapped isIntN() arguments in decodeOffset_16_16Operand: the untrusted +/// immediate is passed as the bit width N. When the 4-bit offset field is 0, +/// N becomes 0 and isIntN shifts by (unsigned)(0 - 1), which is UB. The word +/// below is an ee.ldf.128.ip with a zero offset field. +static void test_ub_isintn_xtensa_offset(void) +{ + static const uint8_t code[] = { 0x2f, 0x70, 0x44, 0x84 }; + + csh handle; + if (cs_open(CS_ARCH_XTENSA, CS_MODE_XTENSA_ESP32, &handle) != CS_ERR_OK) + return; + cs_option(handle, CS_OPT_DETAIL, CS_OPT_ON); + + cs_insn *insn = NULL; + size_t count = cs_disasm(handle, code, sizeof(code), 0x1000, 0, &insn); + cs_free(insn, count); + cs_close(&handle); + return; +} + int main() { test_overflow_cs_insn_bytes(); test_overflow_cs_insn_bytes_iter(); test_overflow_set_reg_mem_n(); test_ub_shift_sh_dsp_p(); + test_ub_isintn_xtensa_offset(); return 0; } From 553537d227c4c89675a58ac6391e7785e08912ce Mon Sep 17 00:00:00 2001 From: Syed Mohammed Nayyar Date: Sun, 5 Jul 2026 13:10:35 +0530 Subject: [PATCH 2/2] xtensa: add issues.yaml regression for ee.ldf.128.ip zero offset Signed-off-by: Syed Mohammed Nayyar --- tests/issues/issues.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/tests/issues/issues.yaml b/tests/issues/issues.yaml index 1ded37ff09..20f56ed289 100644 --- a/tests/issues/issues.yaml +++ b/tests/issues/issues.yaml @@ -6234,6 +6234,17 @@ test_cases: - asm_text: "l32i.n a1, a3, 8" illegal: -1 + - + input: + name: "#2986 Xtensa decodeOffset_16_16Operand swapped isIntN arguments" + bytes: [ 0x2f, 0x70, 0x44, 0x84 ] + arch: "CS_ARCH_XTENSA" + options: [ CS_MODE_XTENSA_ESP32 ] + address: 0x0 + expected: + insns: + - asm_text: "ee.ldf.128.ip f8, f9, f7, f4, a2, 0" + - input: name: "#2722 - CS_OPT_UNSIGNED is ignored for most archs"