DynamoRIO / DynamoRIO/dynamorio

Fix instructions, e.g., vcvtps2pd, that have wrong operand sizes

Open
#4,297 12 comments 0 reactions 0 assignees View on GitHub
Component-IR
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 18h
Merged PRs (30d)
30

Description

https://www.felixcloutier.com/x86/cvtps2pd says:
> 128-bit Legacy SSE version: The source operand is an XMM register or 64- bit memory location.

DR master has: https://github.com/DynamoRIO/dynamorio/blob/d275a9aee4e2260cda0b7ce3f5e47f6f1b668320/core/arch/x86/decode_table.c
```
#define Wps TYPE_W, OPSZ_16
...
{OP_cvtps2pd, 0x0f5a10, "cvtps2pd", Vpd, xx, Wps, xx, xx, mrm, x, END_LIST},
```

The Intel docs are clearly correct here, I'm observing an application reading from the 8 bytes at the end of a memory mapping.

Contributor guide

Open the contributing guide

Research direction

Start at core/arch/x86/decode_table.c and compare the affected instruction definitions with Intel's x86 instruction reference linked in the issue. Audit related instructions beyond cvtps2pd, then correct their operand-size metadata. Done means the decoder entries match the documented widths, including the 64-bit legacy SSE memory operand.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
devtools, reverse-engineering
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.