mirror of
https://github.com/capstone-engine/capstone.git
synced 2026-10-12 02:11:43 +00:00
SaminaandRot127
e330ce90c9
The ISA defines the offset as zero_extend(offset||0^2), but the non-MMR6 path in DecodeMemMMReglistImm4Lsl2 sign-extended the 4-bit field before the << 2. When the field's top bit is set that makes Offset negative, so Offset << 2 is a left shift of a negative value (UB), and the decoded offset came out negative instead of the zero-extended value the ISA requires. Use fieldFromInstruction_4(Insn, 0, 4) to extract the field unsigned, matching the MMR6 branch and the ISA. The shift is now always applied to a non-negative value. Verified under -fsanitize=undefined: before, cstool micromips 4508 and test_poc abort at MipsDisassembler.c:2432 with 'left shift of negative value -8'; after, test_poc exits clean and cstool prints 'lwm16 $s0, $ra, 0x20($sp)' (8 << 2 == 0x20). Signed-off-by: bibi samina <[email protected]> Co-authored-by: Rot127 <[email protected]>