commit e05f998dd192a31212dfa134c91cab555061897c
author Catena cyber <35799796+catenacyber@users.noreply.github.com> Fri Jun 01 14:52:37 2018 +0200
committer Nguyen Anh Quynh <aquynh@gmail.com> Fri Jun 01 20:52:37 2018 +0800
tree 098f7343a9cdceed9da5d106726439d8bd56f6d4
parent 08b1cfa23512e19d56f7a13b229e7f8a8ef7f931

Fix buffer overflow in M68K (#1146)

arch/M68K/M68KDisassembler.c

diff --git a/arch/M68K/M68KDisassembler.c b/arch/M68K/M68KDisassembler.c
index c378587..bc487ac 100644
--- a/arch/M68K/M68KDisassembler.c
+++ b/arch/M68K/M68KDisassembler.c
@@ -188,7 +188,7 @@
 static unsigned int m68k_read_safe_16(const m68k_info *info, const uint64_t address)
 {
 	const uint64_t addr = (address - info->baseAddress) & info->address_mask;
-	if (info->code_len < 2) {
+	if (info->code_len < addr + 2) {
 		return 0xaaaa;
 	}
 	return m68k_read_disassembler_16(info, addr);
@@ -197,7 +197,7 @@
 static unsigned int m68k_read_safe_32(const m68k_info *info, const uint64_t address)
 {
 	const uint64_t addr = (address - info->baseAddress) & info->address_mask;
-	if (info->code_len < 4) {
+	if (info->code_len < addr + 4) {
 		return 0xaaaaaaaa;
 	}
 	return m68k_read_disassembler_32(info, addr);
@@ -206,7 +206,7 @@
 static uint64_t m68k_read_safe_64(const m68k_info *info, const uint64_t address)
 {
 	const uint64_t addr = (address - info->baseAddress) & info->address_mask;
-	if (info->code_len < 8) {
+	if (info->code_len < addr + 8) {
 		return 0xaaaaaaaaaaaaaaaaLL;
 	}
 	return m68k_read_disassembler_64(info, addr);