On 25 December 2014 at 05:10, Michael Tokarev <m...@tls.msk.ru> wrote: > 22.12.2014 20:47, Peter Maydell wrote: >> The m68k signal frame setup code which writes the signal return >> trampoline code to the stack was assuming that a 'long' was 32 bits; >> on 64 bit systems this meant we would end up writing the 32 bit >> (2 insn) trampoline sequence to retaddr+4,retaddr+6 instead of >> the intended retaddr+0,retaddr+2, resulting in a guest crash when >> it tried to execute the invalid zero-bytes at retaddr+0. >> Fix by using uint32_t instead; also use uint16_t rather than short >> for consistency. This fixes bug LP:1404690. > > Cc: qemu-stable@ ?
Yeah, seems reasonable (though this has been busted for five years, so I deduce that nobody's actually trying to use it...) -- PMM
