Browse code

bytecode_vm: fix memset on bigendian arch (bb #2478).

Otherwise memset's count is always 0, and we are using uninitialized bytes,
causing bytecode to misbehave.

Török Edvin authored on 2011/01/20 23:09:50
Showing 2 changed files
... ...
@@ -1,3 +1,7 @@
1
+Thu Jan 20 16:09:29 EET 2011 (edwin)
2
+-----------------------------------
3
+ * libclamav/bytecode_vm.c: fix memset on bigendian arch (bb #2478).
4
+
1 5
 Thu Jan 20 11:38:33 EET 2011 (edwin)
2 6
 ------------------------------------
3 7
  * libclamav/pdf.c: fix missed detection (bb #2455).
... ...
@@ -226,7 +226,6 @@ static always_inline struct stack_entry *allocate_stack(struct stack *stack,
226 226
     entry->bb_inst = bb_inst;
227 227
     /* we allocated room for values right after stack_entry! */
228 228
     entry->values = values = (char*)&entry[1];
229
-
230 229
     memcpy(&values[func->numBytes - func->numConstants*8], func->constants,
231 230
 	   sizeof(*values)*func->numConstants*8);
232 231
     return entry;
... ...
@@ -1125,40 +1124,41 @@ int cli_vm_execute(const struct cli_bc *bc, struct cli_bc_ctx *ctx, const struct
1125 1125
 		break;
1126 1126
 	    }
1127 1127
 	    DEFINE_OP(OP_BC_MEMCPY) {
1128
-		int32_t arg3;
1128
+		int64_t arg3;
1129 1129
 		void *arg1, *arg2;
1130 1130
 		int64_t res=0;
1131 1131
 
1132
-		READ32(arg3, inst->u.three[2]);
1132
+		READ64(arg3, inst->u.three[2]);
1133 1133
 		READPOP(arg1, inst->u.three[0], arg3);
1134 1134
 		READPOP(arg2, inst->u.three[1], arg3);
1135
-		memcpy(arg1, arg2, arg3);
1135
+		memcpy(arg1, arg2, (int32_t)arg3);
1136 1136
 /*		READ64(res, inst->u.three[0]);*/
1137 1137
 		WRITE64(inst->dest, res);
1138 1138
 		break;
1139 1139
 	    }
1140 1140
 	    DEFINE_OP(OP_BC_MEMMOVE) {
1141
-		int32_t arg3;
1141
+		int64_t arg3;
1142 1142
 		void *arg1, *arg2;
1143 1143
 		int64_t res=0;
1144 1144
 
1145
-		READ32(arg3, inst->u.three[2]);
1145
+		READ64(arg3, inst->u.three[2]);
1146 1146
 		READPOP(arg1, inst->u.three[0], arg3);
1147 1147
 		READPOP(arg2, inst->u.three[1], arg3);
1148
-		memmove(arg1, arg2, arg3);
1148
+		memmove(arg1, arg2, (int32_t)arg3);
1149 1149
 /*		READ64(res, inst->u.three[0]);*/
1150 1150
 		WRITE64(inst->dest, res);
1151 1151
 		break;
1152 1152
 	    }
1153 1153
 	    DEFINE_OP(OP_BC_MEMSET) {
1154
-		int32_t arg2, arg3;
1154
+		int64_t arg3;
1155
+		int32_t arg2;
1155 1156
 		void *arg1;
1156 1157
 		int64_t res=0;
1157 1158
 
1158
-		READ32(arg3, inst->u.three[2]);
1159
+		READ64(arg3, inst->u.three[2]);
1159 1160
 		READPOP(arg1, inst->u.three[0], arg3);
1160 1161
 		READ32(arg2, inst->u.three[1]);
1161
-		memset(arg1, arg2, arg3);
1162
+		memset(arg1, arg2, (int32_t)arg3);
1162 1163
 /*		READ64(res, inst->u.three[0]);*/
1163 1164
 		WRITE64(inst->dest, res);
1164 1165
 		break;