<div dir="ltr"><div>Hi,</div><div><br></div><div>Sorry I missed the main thought here.<br>The "gen_group_get_length" function returns <b>int</b><br>but the "iter_group_offset_bits" function returns <b>uint32_t</b><br>So <b>uint32_t</b>(<b>int</b>(-32)) = <b>0xFFFFFFE0U</b> and it looks like unexpected behavior for me:</div><div>iter_group_offset_bits(iter, iter->group_iter + 1) < <b>0xFFFFFFE0U</b>;<br></div><div><br></div><div>Regards,</div><div>Andrii.</div><div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Aug 9, 2018 at 2:35 PM, Andrii Simiklit <span dir="ltr"><<a href="mailto:asimiklit.work@gmail.com" target="_blank">asimiklit.work@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">The "gen_group_get_length" function can return a negative value<br>
and it can lead to the out of bounds group_iter.<br>
<br>
Signed-off-by: Andrii Simiklit <<a href="mailto:andrii.simiklit@globallogic.com" target="_blank">andrii.simiklit@globallogic.c<wbr>om</a>><br>
---<br>
src/intel/common/gen_decoder.<wbr>c | 6 ++++--<br>
1 file changed, 4 insertions(+), 2 deletions(-)<br>
<br>
diff --git a/src/intel/common/gen_decoder<wbr>.c b/src/intel/common/gen_decoder<wbr>.c<br>
index ec0a486..f09bd87 100644<br>
--- a/src/intel/common/gen_decoder<wbr>.c<br>
+++ b/src/intel/common/gen_decoder<wbr>.c<br>
@@ -803,8 +803,10 @@ static bool<br>
iter_more_groups(const struct gen_field_iterator *iter)<br>
{<br>
if (iter->group->variable) {<br>
- return iter_group_offset_bits(iter, iter->group_iter + 1) <<br>
- (gen_group_get_length(iter->gr<wbr>oup, iter->p) * 32);<br>
+ const int length = gen_group_get_length(iter->gro<wbr>up, iter->p);<br>
+ return length > 0 &&<br>
+ iter_group_offset_bits(iter, iter->group_iter + 1) <<br>
+ (length * 32);<br>
} else {<br>
return (iter->group_iter + 1) < iter->group->group_count ||<br>
iter->group->next != NULL;<br>
<span class="m_-6307854769801606493gmail-HOEnZb"><font color="#888888">-- <br>
2.7.4<br>
<br>
</font></span></blockquote></div><br></div></div></div>