Skip to content

xtensa: fix swapped isIntN arguments in decodeOffset_16_16Operand #2986

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jmestwa-coder wants to merge 2 commits into
base: next
Choose a base branch
from
+33 −1
Open

xtensa: fix swapped isIntN arguments in decodeOffset_16_16Operand #2986

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7280462
xtensa: fix swapped isIntN arguments in decodeOffset_16_16Operand
jmestwa-coder Jul 4, 2026
553537d
xtensa: add issues.yaml regression for ee.ldf.128.ip zero offset
jmestwa-coder Jul 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion arch/Xtensa/XtensaDisassembler.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -788,7 +788,7 @@ static DecodeStatus decodeOffset_16_16Operand(MCInst *Inst, uint64_t Imm,
int64_t Address,
const void *Decoder)
{
CS_ASSERT_RET_VAL(isIntN(Imm, 8) && "Invalid immediate",
CS_ASSERT_RET_VAL(isIntN(8, Imm) && "Invalid immediate",
MCDisassembler_Fail);
if ((Imm & 0xf) != 0)
MCOperand_CreateImm0(Inst, (Imm << 4));
Expand Down
21 changes: 21 additions & 0 deletions tests/integration/test_poc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,12 +130,33 @@ static void test_ub_shift_sh_dsp_p(void)
return;
}

/// Swapped isIntN() arguments in decodeOffset_16_16Operand: the untrusted
/// immediate is passed as the bit width N. When the 4-bit offset field is 0,
/// N becomes 0 and isIntN shifts by (unsigned)(0 - 1), which is UB. The word
/// below is an ee.ldf.128.ip with a zero offset field.
static void test_ub_isintn_xtensa_offset(void)
{
static const uint8_t code[] = { 0x2f, 0x70, 0x44, 0x84 };

csh handle;
if (cs_open(CS_ARCH_XTENSA, CS_MODE_XTENSA_ESP32, &handle) != CS_ERR_OK)
return;
cs_option(handle, CS_OPT_DETAIL, CS_OPT_ON);

cs_insn *insn = NULL;
size_t count = cs_disasm(handle, code, sizeof(code), 0x1000, 0, &insn);
cs_free(insn, count);
cs_close(&handle);
return;
}

int main()
{
test_overflow_cs_insn_bytes();
test_overflow_cs_insn_bytes_iter();
test_overflow_set_reg_mem_n();
test_ub_shift_sh_dsp_p();
test_ub_isintn_xtensa_offset();

return 0;
}
11 changes: 11 additions & 0 deletions tests/issues/issues.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6234,6 +6234,17 @@ test_cases:
- asm_text: "l32i.n a1, a3, 8"
illegal: -1

-
input:
name: "#2986 Xtensa decodeOffset_16_16Operand swapped isIntN arguments"
bytes: [ 0x2f, 0x70, 0x44, 0x84 ]
arch: "CS_ARCH_XTENSA"
options: [ CS_MODE_XTENSA_ESP32 ]
address: 0x0
expected:
insns:
- asm_text: "ee.ldf.128.ip f8, f9, f7, f4, a2, 0"

@Rot127 Rot127 Jul 6, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please also test the details. More test coverage is always better.


-
input:
name: "#2722 - CS_OPT_UNSIGNED is ignored for most archs"
Expand Down
Loading