According to the Intel specs, lsl performs a check against NULL for the
provided selector, just like lar does. helper_lar() includes the
corresponding code, helper_lsl() was lacking it so far.
Signed-off-by: Jan Kiszka <address@hidden>
---
target-i386/op_helper.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/target-i386/op_helper.c b/target-i386/op_helper.c
index 25e079b..be09263 100644
--- a/target-i386/op_helper.c
+++ b/target-i386/op_helper.c
@@ -3241,6 +3241,8 @@ target_ulong helper_lsl(target_ulong selector1)
selector = selector1 & 0xffff;
eflags = helper_cc_compute_all(CC_OP);
+ if ((selector & 0xfffc) == 0)
+ goto fail;
if (load_segment(&e1, &e2, selector) != 0)
goto fail;
rpl = selector & 3;