PR26468 UBSAN: tc-mep.c:1684 left shift of negative value

	PR 26468
	* config/tc-mep.c (md_convert_frag): Use uint32_t for addend and
	other variables.

diff --git a/gas/ChangeLog b/gas/ChangeLog
index 9336a6152b51a8bf08a92d59f66aa8b653bb3e43..7b6b28dcf0460fa29a22e0976e2e2e354942ba4c 100644 (file)
--- a/gas/ChangeLog
+++ b/gas/ChangeLog
@@ -1,3 +1,9 @@
+2020-08-31  Alan Modra  <amodra@gmail.com>
+
+       PR 26468
+       * config/tc-mep.c (md_convert_frag): Use uint32_t for addend and
+       other variables.
+
 2020-08-31  Alan Modra  <amodra@gmail.com>
 
        PR 26493

diff --git a/gas/config/tc-mep.c b/gas/config/tc-mep.c
index 6b52841fa9dacd799cb174a9fe021258007a95af..e588a30afc0dad18c5c4ad98147db3192515b0f2 100644 (file)
--- a/gas/config/tc-mep.c
+++ b/gas/config/tc-mep.c
@@ -1617,7 +1617,7 @@ md_convert_frag (bfd *abfd  ATTRIBUTE_UNUSED,
                 segT seg ATTRIBUTE_UNUSED,
                 fragS *fragP)
 {
-  int addend, rn, bit = 0;
+  uint32_t addend, rn, bit = 0;
   int operand;
   int where = fragP->fr_opcode - fragP->fr_literal;
   int e = target_big_endian ? 0 : 1;
@@ -1697,7 +1697,7 @@ md_convert_frag (bfd *abfd  ATTRIBUTE_UNUSED,
        /* The default relax_frag doesn't change the state if there is no
           growth, so we must manually handle converting out-of-range BEQ
           instructions to JMP.  */
-       if (addend <= 65535 && addend >= -65536)
+       if (addend + 65536 < 131071)
          {
            if (core_mode)
              fragP->fr_fix += 2;