Kevin Puetz : rpcrt4: Fix ARM64 stack corruption in call_server_func.
Alexandre Julliard
julliard at winehq.org
Fri Sep 18 15:52:49 CDT 2020
Module: wine
Branch: master
Commit: e4e7be6bd9e8a70329f5ceb4f6d66f50e3170ae2
URL: https://source.winehq.org/git/wine.git/?a=commit;h=e4e7be6bd9e8a70329f5ceb4f6d66f50e3170ae2
Author: Kevin Puetz <PuetzKevinA at JohnDeere.com>
Date: Thu Sep 17 19:52:46 2020 -0500
rpcrt4: Fix ARM64 stack corruption in call_server_func.
calls with stack_size > 16 pop argument values into x3, overwriting
the number of 16-byte stack octwords. This breaks the checks for popping
x4..x7 and potentially unbalances sp (based on the vaue of args[16..23]).
Use a scratch register (x9) for this count so its lifetime does not
conflict with preparing the parameter/result registers.
Signed-off-by: Kevin Puetz <PuetzKevinA at JohnDeere.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>
---
dlls/rpcrt4/ndr_stubless.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/dlls/rpcrt4/ndr_stubless.c b/dlls/rpcrt4/ndr_stubless.c
index 9f579fcfd4..43debcb91d 100644
--- a/dlls/rpcrt4/ndr_stubless.c
+++ b/dlls/rpcrt4/ndr_stubless.c
@@ -1180,24 +1180,24 @@ LONG_PTR __cdecl call_server_func(SERVER_ROUTINE func, unsigned char *args, unsi
__ASM_GLOBAL_FUNC( call_server_func,
"stp x29, x30, [sp, #-16]!\n\t"
"mov x29, sp\n\t"
- "add x3, x2, #15\n\t"
- "lsr x3, x3, #4\n\t"
- "sub sp, sp, x3, lsl #4\n\t"
+ "add x9, x2, #15\n\t"
+ "lsr x9, x9, #4\n\t"
+ "sub sp, sp, x9, lsl #4\n\t"
"cbz x2, 2f\n"
"1:\tsub x2, x2, #8\n\t"
"ldr x4, [x1, x2]\n\t"
"str x4, [sp, x2]\n\t"
"cbnz x2, 1b\n"
"2:\tmov x8, x0\n\t"
- "cbz x3, 3f\n\t"
+ "cbz x9, 3f\n\t"
"ldp x0, x1, [sp], #16\n\t"
- "cmp x3, #1\n\t"
+ "cmp x9, #1\n\t"
"b.le 3f\n\t"
"ldp x2, x3, [sp], #16\n\t"
- "cmp x3, #2\n\t"
+ "cmp x9, #2\n\t"
"b.le 3f\n\t"
"ldp x4, x5, [sp], #16\n\t"
- "cmp x3, #3\n\t"
+ "cmp x9, #3\n\t"
"b.le 3f\n\t"
"ldp x6, x7, [sp], #16\n"
"3:\tblr x8\n\t"
More information about the wine-cvs
mailing list