Repository navigation
arch/PowerPC: fix uninitialized read of insn->mnemonic in PPC_post_printer - #3005
Merged
Rot127 merged 2 commits intoJul 24, 2026
Merged
Conversation
…inter and add regression tests Derive the update_cr0 and branch-hint checks from the last char of the mnemonic token of insn_asm, which always holds the current instruction's text; also clear insn->mnemonic in fill_insn() before the post printer runs so no post printer can rely on stale contents again.
phix33
force-pushed
the
v5-ppc-postprinter-uninit-mnemonic
branch
from
July 24, 2026 08:54
79fd0ce to
0448c31
Compare
Rot127
requested changes
Jul 24, 2026
Rot127
left a comment
Collaborator
There was a problem hiding this comment.
Thanks for the fix!
Please add the test to the CI and we are good to go.
Collaborator
There was a problem hiding this comment.
in order to run this test you need to add a step in CITest.yaml.
Its a little more annoying than on the next branch because here it was never refactored.
Just adding a simple new step below the cstest one should be enough.
Contributor
Author
|
Added a CI step below cstest that runs the test in all three Linux jobs" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Your checklist for this pull request
Detailed description
PPC_post_printer() derives update_cr0 and bh from insn->mnemonic, which is not filled at that point: fill_insn() in cs.c invokes the post printer before copying the mnemonic out of the printed buffer, so reading insn->mnemonic there is wrong by construction. It normally works only because PPC_printInst() copies the first output token into flat_insn->mnemonic — but five alias paths (mr, slwi/srwi, sldi, dcbt/dcbtst, dcbf) return early and skip that copy, so the post-printer reads memory the engine never wrote.
With cs_disasm_iter() (which reuses one cs_insn by design) the effect is deterministic: decoding add. then mr reports mr with update_cr0 = true; decoding bne+ then mr gives mr a branch hint. With cs_disasm() the result depends on heap contents (valgrind flags the read). Found via a randomly failing radare2 test; radare2 currently carries a workaround (radare2@2646d7712a).
Fix, in two parts:
A fully structured derivation (no text parsing at all) was considered and deliberately not done here: update_cr0 from the register-write map (cs_reg_write(CR0) in PPC_get_insn_id) is not equivalent to the printed-dot semantics — FP record forms write CR1 (fadd.) and Altivec record forms write CR6 (vcmpequb.), so it would silently change the reported update_cr0 for those; and the branch hint is emitted by four independent printer mechanisms in v5, so there is no single place to set bh structurally. next is not affected either way (post_printer is NULL there and fill_insn() zeroes the mnemonic).
Test plan
tests/test_ppc_iter_detail.c (self-checking, runs under ctest; 7/16 checks fail before the fix, all pass after) plus three issues.cs entries pinning the preserved positives (add. sets Update-CR0, bne+/bne- report hints). Existing PPC issues.cs and suite/MC/PowerPC pass unchanged, and the full ctest suite (all arches) passes, confirming the fill_insn() change is a no-op everywhere else.
Closing issues
"None".