Crash/assert with large value of LocalLabelVal in llvm::MCContext::createDirectionalLocalSymbol() about keystone

[aquynh]

Cool, can you have a fix for this issue?

[ekse]

I don't know much about ARM, this document seems to be saying that valid local llabel values are in the range 0-99. Can we get someone to confirm?

http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0068b/Caccjfff.html

[ekse]

The code in AsmParser.cpp is generic for all assembly formats. The tombstone values (special markers) in DenseMap are defined as ~0 and ~0 - 1 which I think will be different values depending if keystone is compiled as 32 or 64-bit.

I think the easiest way to fix this issue would be to set an arbitrary maximum value, say 100,000, for the local label. That should be plenty enough, ARM supports up to 99 for example. Thoughts?

[aquynh]

No we should not limit the number of labels.

[ekse]

I'm not suggesting to limit the number of labels, I'm suggesting to limit the value of local labels. They work as an offset in the assembly code, see the following example.

http://stackoverflow.com/questions/32341112/arm-assembly-local-labels

[aquynh]

it seems LLVM does not have any standard here, so yes lets set 99 as the limit for the label value. can you come up with a patch?

thanks.

[ekse]

Here is the pull request.

[aquynh]

i just pushed a commit to fix this, can you confirm?

[ekse]

Unfortunately this breaks numeric local label:

When assembling with a previous build

~/g/k/build3 (master) $ kstool arm "1:blt 1b"
1:blt 1b = [ fe ff ff ba ]

When assembling with the current build

~/g/k/build3 (master) $ kstool arm "1:blt 1b"
ERROR: failed on ks_asm() with count = 0, error = 'Invalid label (KS_ERR_ASM_LABEL_INVALID)' (code = 160)

The problem is with the condition if (LocalLabelVal >= Instances.size(). Instances.size() returns the number of elements currently in the DenseMap, MCContext::NextInstance() and MCContext::GetInstance() are used to add new entries in the map (see the comments in MCContext.h). The out-of-bounds access Instances[LocalLabelVal] is handled via operator overloading. If the condition is changed to if (LocalLabelVal >= 100 for example the example works as expected.

[aquynh]

ok, let me make another fix. can you send a PR for this new testcase so we will not break that in the future?