Skip to content

[DYNAREC] Fixed callret=2 with always_test out-of-bounds read #3790

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ptitSeb merged 1 commit into from
Apr 18, 2026
Merged

[DYNAREC] Fixed callret=2 with always_test out-of-bounds read #3790

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions src/dynarec/arm64/dynarec_arm64_00.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3825,7 +3825,7 @@ uintptr_t dynarec64_00(dynarec_arm_t* dyn, uintptr_t addr, uintptr_t ip, int nin
// Push actual return address
if(addr < (dyn->start+dyn->isize)) {
// there is a next...
if(BOX64DRENV(dynarec_callret)>1)
if(BOX64DRENV(dynarec_callret)>1 && !dyn->always_test)
j64 = CALLRET_GETRET();
else
j64 = (dyn->insts)?(dyn->insts[ninst].epilog-(dyn->native_size)):0;
Expand Down Expand Up @@ -4533,7 +4533,7 @@ uintptr_t dynarec64_00(dynarec_arm_t* dyn, uintptr_t addr, uintptr_t ip, int nin
// Push actual return address
if(addr < (dyn->start+dyn->isize)) {
// there is a next...
if(BOX64DRENV(dynarec_callret)>1)
if(BOX64DRENV(dynarec_callret)>1 && !dyn->always_test)
j64 = CALLRET_GETRET();
else
j64 = (dyn->insts)?(dyn->insts[ninst].epilog-(dyn->native_size)):0;
Expand Down Expand Up @@ -4588,14 +4588,14 @@ uintptr_t dynarec64_00(dynarec_arm_t* dyn, uintptr_t addr, uintptr_t ip, int nin
// Push actual return address. Note that CS will not be tested, but that should be ok?
if(can_continue) {
// there is a next...
if(BOX64DRENV(dynarec_callret)>1)
if(BOX64DRENV(dynarec_callret)>1 && !dyn->always_test)
j64 = CALLRET_GETRET();
else
j64 = (dyn->insts)?(dyn->insts[ninst].epilog-(dyn->native_size)):0;
ADR_S20(x4, j64);
MESSAGE(LOG_NONE, "\tCALLRET set return to +%di\n", j64>>2);
} else {
if(BOX64DRENV(dynarec_callret)>1)
if(BOX64DRENV(dynarec_callret)>1 && !dyn->always_test)
j64 = CALLRET_GETRET();
else
j64 = (dyn->insts)?(GETMARK-(dyn->native_size)):0;
Expand Down
8 changes: 4 additions & 4 deletions src/dynarec/la64/dynarec_la64_00.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3382,7 +3382,7 @@ uintptr_t dynarec64_00(dynarec_la64_t* dyn, uintptr_t addr, uintptr_t ip, int ni
// Push actual return address
if (addr < (dyn->start + dyn->isize)) {
// there is a next...
if(BOX64DRENV(dynarec_callret)>1)
if(BOX64DRENV(dynarec_callret)>1 && !dyn->always_test)
j64 = CALLRET_GETRET();
else
j64 = (dyn->insts) ? (dyn->insts[ninst].epilog - (dyn->native_size)) : 0;
Expand Down Expand Up @@ -4023,7 +4023,7 @@ uintptr_t dynarec64_00(dynarec_la64_t* dyn, uintptr_t addr, uintptr_t ip, int ni
// Push actual return address
if (addr < (dyn->start + dyn->isize)) {
// there is a next
if(BOX64DRENV(dynarec_callret)>1)
if(BOX64DRENV(dynarec_callret)>1 && !dyn->always_test)
j64 = CALLRET_GETRET();
else
j64 = (dyn->insts) ? (dyn->insts[ninst].epilog - (dyn->native_size)) : 0;
Expand Down Expand Up @@ -4082,15 +4082,15 @@ uintptr_t dynarec64_00(dynarec_la64_t* dyn, uintptr_t addr, uintptr_t ip, int ni
// Push actual return address. Note that CS will not be tested, but that should be ok?
if (can_continue) {
// there is a next...
if(BOX64DRENV(dynarec_callret)>1)
if(BOX64DRENV(dynarec_callret)>1 && !dyn->always_test)
j64 = CALLRET_GETRET();
else
j64 = (dyn->insts) ? (dyn->insts[ninst].epilog - (dyn->native_size)) : 0;
PCADDU12I(x4, ((j64 + 0x800) >> 12) & 0xfffff);
ADDI_D(x4, x4, j64 & 0xfff);
MESSAGE(LOG_NONE, "\tCALLRET set return to +%di\n", j64 >> 2);
} else {
if(BOX64DRENV(dynarec_callret)>1)
if(BOX64DRENV(dynarec_callret)>1 && !dyn->always_test)
j64 = CALLRET_GETRET();
else
j64 = (dyn->insts) ? (GETMARK - (dyn->native_size)) : 0;
Expand Down
4 changes: 2 additions & 2 deletions src/dynarec/la64/dynarec_la64_pass3.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,7 @@
} while (0)
#define CALLRET_RET(A) \
do { \
if((A) && ISSEP() && BOX64DRENV(dynarec_callret) && !dyn->always_test) {\
if((A) && ISSEP() && BOX64DRENV(dynarec_callret)) { \
MESSAGE(LOG_DUMP, " Dynablock*\n"); \
dyn->block += sizeof(void*); \
dyn->native_size+=sizeof(void*); \
Expand All @@ -74,7 +74,7 @@
dyn->sep[dyn->sep_size].nat_offs = dyn->native_size; \
++dyn->sep_size; \
} \
if((A) && (BOX64DRENV(dynarec_callret)>1)) { \
if((A) && (BOX64DRENV(dynarec_callret)>1) && !dyn->always_test) { \
dyn->callrets[dyn->callret_size].type = 0; \
dyn->callrets[dyn->callret_size++].offs = dyn->native_size; \
EMIT(ARCH_NOP); \
Expand Down
6 changes: 3 additions & 3 deletions src/dynarec/rv64/dynarec_rv64_00_3.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1147,7 +1147,7 @@ uintptr_t dynarec64_00_3(dynarec_rv64_t* dyn, uintptr_t addr, uintptr_t ip, int
// Push actual return address
if(can_continue) {
// there is a next...
if(BOX64DRENV(dynarec_callret)>1)
if(BOX64DRENV(dynarec_callret)>1 && !dyn->always_test)
j64 = CALLRET_GETRET();
else
j64 = (dyn->insts)?(GETMARK-(dyn->native_size)):0;
Expand Down Expand Up @@ -1714,7 +1714,7 @@ uintptr_t dynarec64_00_3(dynarec_rv64_t* dyn, uintptr_t addr, uintptr_t ip, int
// Push actual return address
if(addr < (dyn->start+dyn->isize)) {
// there is a next...
if(BOX64DRENV(dynarec_callret)>1)
if(BOX64DRENV(dynarec_callret)>1 && !dyn->always_test)
j64 = CALLRET_GETRET();
else
j64 = (dyn->insts)?(GETMARK-(dyn->native_size)):0;
Expand Down Expand Up @@ -1777,7 +1777,7 @@ uintptr_t dynarec64_00_3(dynarec_rv64_t* dyn, uintptr_t addr, uintptr_t ip, int
// Push actual return address
if(addr < (dyn->start+dyn->isize)) {
// there is a next...
if(BOX64DRENV(dynarec_callret)>1)
if(BOX64DRENV(dynarec_callret)>1 && !dyn->always_test)
j64 = CALLRET_GETRET();
else
j64 = (dyn->insts)?(GETMARK-(dyn->native_size)):0;
Expand Down
4 changes: 2 additions & 2 deletions src/dynarec/rv64/dynarec_rv64_pass2.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,11 +55,11 @@
EMIT(0); \
EMIT(0); \
} while (0)
#define CALLRET_RET(A) do { \
#define CALLRET_RET(A) do { \
if((A) && ISSEP() && BOX64DRENV(dynarec_callret)) { \
dyn->insts[ninst].size+=sizeof(void*); dyn->native_size+=sizeof(void*); dyn->insts[ninst+1].sep=1; ++dyn->sep_size; \
} \
if((A) && (BOX64DRENV(dynarec_callret)>1)) { \
if((A) && (BOX64DRENV(dynarec_callret)>1) && !dyn->always_test) { \
dyn->callrets[dyn->callret_size].type = 0; dyn->callrets[dyn->callret_size++].offs = dyn->native_size; EMIT(ARCH_NOP); \
} \
} while(0)
Expand Down
4 changes: 2 additions & 2 deletions src/dynarec/rv64/dynarec_rv64_pass3.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@
return 0
#define CALLRET_RET(A) \
do { \
if((A) && ISSEP() && BOX64DRENV(dynarec_callret) && !dyn->always_test) {\
if((A) && ISSEP() && BOX64DRENV(dynarec_callret)) {\
MESSAGE(LOG_DUMP, " Dynablock*\n"); \
dyn->block += sizeof(void*); \
dyn->native_size+=sizeof(void*); \
Expand All @@ -89,7 +89,7 @@
dyn->sep[dyn->sep_size].nat_offs = dyn->native_size; \
++dyn->sep_size; \
} \
if((A) && (BOX64DRENV(dynarec_callret)>1)) { \
if((A) && (BOX64DRENV(dynarec_callret)>1) && !dyn->always_test) { \
dyn->callrets[dyn->callret_size].type = 0; \
dyn->callrets[dyn->callret_size++].offs = dyn->native_size; \
EMIT(ARCH_NOP); \
Expand Down
Loading