Skip to content

riscv: propagate register-class decode failure in custom decoders - #3071

Open
jmestwa-coder wants to merge 1 commit into
capstone-engine:nextfrom
jmestwa-coder:riscv-reg-decode-status
Open

riscv: propagate register-class decode failure in custom decoders#3071
jmestwa-coder wants to merge 1 commit into
capstone-engine:nextfrom
jmestwa-coder:riscv-reg-decode-status

Conversation

@jmestwa-coder

Copy link
Copy Markdown
Contributor

Your checklist for this pull request

  • I've documented or updated the documentation of every API function and struct this PR changes.
  • I've added tests that prove my fix is effective or that my feature works (if possible)

Detailed description

Several hand-written RISC-V decoders drop the status of Decode*RegisterClass:

  • decodeRegReg, decodeRVCInstrRdRs2, decodeRVCInstrRdRs1Rs2, decodeXTHeadMemPair and decodeRVCInstrRdRs1ImmZero call it and ignore the return
  • in RVE mode a general register >= 16 is rejected (also reachable through the COREV and XThead paths), so the operand is never created but the decoder still returns success
  • the printer then reads the missing operand: printRegReg passes a NULL register name to SStream_concat0, which is a NULL deref in release builds; printOperand reads a slot of unknown kind for the compressed and XThead forms
  • the generated table decoders already guard the same calls with Check()

Return MCDisassembler_Fail when the register-class decode fails, at each site.

Test plan

  • cstool -d riscv32+e+corev 2b330a2a (COREV cv.sh) faults on a NULL register name before the fix; after it, the word is rejected
  • added test_riscv_rve_unchecked_reg_decode to tests/integration/test_poc.c, one input per fixed decoder, run under the ASAN/UBSan job
  • added the rejected words to tests/issues/fuzzing.yaml
  • ctest --test-dir build is green

Closing issues

The hand-written decoders ignored the status of Decode*RegisterClass, so an out-of-range register (RVE mode, and the COREV/XTHead paths) left the operand uncreated while the instruction still decoded as success. The printer then read the missing operand, dereferencing a NULL register name in release builds. Check the status and fail the decode, matching the generated table decoders.
@github-actions github-actions Bot added the RISCV Arch label Sep 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

RISCV Arch

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant