From aa9744eec81a9b7612dca49f9b26b4d37d17ca36 Mon Sep 17 00:00:00 2001
From: caheckman <48068198+caheckman@users.noreply.github.com>
Date: Fri, 25 Oct 2019 16:35:08 -0400
Subject: [PATCH] let CPUI_STORE be potential pointer constant source

---
 .../Decompiler/src/decompile/cpp/coreaction.cc      | 13 +++++++++----
 .../Decompiler/src/decompile/cpp/coreaction.hh      |  3 ++-
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/coreaction.cc b/Ghidra/Features/Decompiler/src/decompile/cpp/coreaction.cc
index 2907863e83..d87d5775fc 100644
--- a/Ghidra/Features/Decompiler/src/decompile/cpp/coreaction.cc
+++ b/Ghidra/Features/Decompiler/src/decompile/cpp/coreaction.cc
@@ -824,10 +824,12 @@ int4 ActionShadowVar::apply(Funcdata &data)
 /// \param spc is the address space being pointed to
 /// \param vn is the given Varnode
 /// \param op is the lone descendant of the Varnode
+/// \param slot is the slot index of the Varnode
 /// \param rampoint will hold the Address of the resolved symbol
 /// \param data is the function being analyzed
 /// \return the recovered symbol or NULL
-SymbolEntry *ActionConstantPtr::isPointer(AddrSpace *spc,Varnode *vn,PcodeOp *op,Address &rampoint,uintb &fullEncoding,Funcdata &data)
+SymbolEntry *ActionConstantPtr::isPointer(AddrSpace *spc,Varnode *vn,PcodeOp *op,int4 slot,
+					  Address &rampoint,uintb &fullEncoding,Funcdata &data)
 
 {
   bool needexacthit;
@@ -849,7 +851,7 @@ SymbolEntry *ActionConstantPtr::isPointer(AddrSpace *spc,Varnode *vn,PcodeOp *op
       // A constant parameter or return value could be a pointer
       if (!glb->infer_pointers)
 	return (SymbolEntry *)0;
-      if (op->getSlot(vn)==0)
+      if (slot==0)
 	return (SymbolEntry *)0;
       break;
     case CPUI_COPY:
@@ -862,7 +864,6 @@ SymbolEntry *ActionConstantPtr::isPointer(AddrSpace *spc,Varnode *vn,PcodeOp *op
     case CPUI_INT_ADD:
       outvn = op->getOut();
       if (outvn->getType()->getMetatype()==TYPE_PTR) {
-	int4 slot = op->getSlot(vn);
 	// Is there another pointer base in this expression
 	if (op->getIn(1-slot)->getType()->getMetatype()==TYPE_PTR)
 	  return (SymbolEntry *)0; // If so, we are not a pointer
@@ -872,6 +873,10 @@ SymbolEntry *ActionConstantPtr::isPointer(AddrSpace *spc,Varnode *vn,PcodeOp *op
       else if (!glb->infer_pointers)
 	return (SymbolEntry *)0;
       break;
+    case CPUI_STORE:
+      if (slot != 2)
+	return (SymbolEntry *)0;
+      break;
     default:
       return (SymbolEntry *)0;
     }
@@ -944,7 +949,7 @@ int4 ActionConstantPtr::apply(Funcdata &data)
       continue;
     Address rampoint;
     uintb fullEncoding;
-    entry = isPointer(rspc,vn,op,rampoint,fullEncoding,data);
+    entry = isPointer(rspc,vn,op,slot,rampoint,fullEncoding,data);
     vn->setPtrCheck();		// Set check flag AFTER searching for symbol
     if (entry != (SymbolEntry *)0) {
       data.spacebaseConstant(op,slot,entry,rampoint,fullEncoding,vn->getSize());
diff --git a/Ghidra/Features/Decompiler/src/decompile/cpp/coreaction.hh b/Ghidra/Features/Decompiler/src/decompile/cpp/coreaction.hh
index 56e4dc2dd1..07cc18900d 100644
--- a/Ghidra/Features/Decompiler/src/decompile/cpp/coreaction.hh
+++ b/Ghidra/Features/Decompiler/src/decompile/cpp/coreaction.hh
@@ -162,7 +162,8 @@ public:
 /// \brief Check for constants, with pointer type, that correspond to global symbols
 class ActionConstantPtr : public Action {
   int4 localcount;		///< Number of passes made for this function
-  static SymbolEntry *isPointer(AddrSpace *spc,Varnode *vn,PcodeOp *op,Address &rampoint,uintb &fullEncoding,Funcdata &data);
+  static SymbolEntry *isPointer(AddrSpace *spc,Varnode *vn,PcodeOp *op,int4 slot,
+				Address &rampoint,uintb &fullEncoding,Funcdata &data);
 public:
   ActionConstantPtr(const string &g) : Action(0,"constantptr",g) {}	///< Constructor
   virtual void reset(Funcdata &data) { localcount = 0; }