with fuzzed source code we might run into this with idx out of bounds. We're going to error out on this later, but let's not access out-of-bounds elements.
Unified · Split
| @@ -735,7 +735,7 @@ static int arg_prepare_reg(int idx) { · 734 unmodified lines | |||
| 735 | /* idx=0: r10, idx=1: r11 */ | 735 | /* idx=0: r10, idx=1: r11 */ |
| 736 | return idx + 10; | 736 | return idx + 10; |
| 737 | else | 737 | else |
| 738 | return arg_regs[idx]; | 738 | return idx >= 0 && idx < REGN ? arg_regs[idx] : 0; |
| 739 | } | 739 | } |
| 740 | 740 | ||
| 741 | /* Generate function call. The function address is pushed first, then | 741 | /* Generate function call. The function address is pushed first, then |
| @@ -1221,7 +1221,7 @@ static int arg_prepare_reg(int idx) { · 479 unmodified lines | |||
| 1221 | /* idx=2: r10, idx=3: r11 */ | 1221 | /* idx=2: r10, idx=3: r11 */ |
| 1222 | return idx + 8; | 1222 | return idx + 8; |
| 1223 | else | 1223 | else |
| 1224 | return arg_regs[idx]; | 1224 | return idx >= 0 && idx < REGN ? arg_regs[idx] : 0; |
| 1225 | } | 1225 | } |
| 1226 | 1226 | ||
| 1227 | /* Generate function call. The function address is pushed first, then | 1227 | /* Generate function call. The function address is pushed first, then |