From 1d334f7b0511fd4f212a623410667ae30124dd9d Mon Sep 17 00:00:00 2001
From: Daniel Botnik <danielbotnik@gmail.com>
Date: Fri, 29 May 2026 16:37:26 +0300
Subject: [PATCH] AArch64: Fix truncation of literal load target address
 (#2878)

Literal load instructions (e.g. `ldr x8, <label>`) map their label
operand as IMM|MEM. AArch64_set_detail_op_imm() diverts every operand
carrying the MEM flag into AArch64_set_detail_op_mem(), which stores the
value into the int32_t memory displacement field. The literal load
target is a PC-relative address that can exceed 32 bits, so it was
silently truncated (e.g. 0x100cdc408 became 0xcdc408).

Only divert an immediate into the memory displacement when a memory
operand is actually being assembled, i.e. its base register was set
right before (prev_is_mem_base) or the previous operand is a write-back
base for a post-indexed offset (prev_is_membase_wb). A standalone
immediate that happens to be flagged IMM|MEM - like the literal load
target - is now emitted as a full 64 bit immediate, consistent with how
adr/adrp report PC-relative targets.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 arch/AArch64/AArch64Mapping.c | 29 ++++++++++++++++++++++++++---
 tests/issues/issues.yaml      | 19 +++++++++++++++++++
 2 files changed, 45 insertions(+), 3 deletions(-)

diff --git a/arch/AArch64/AArch64Mapping.c b/arch/AArch64/AArch64Mapping.c
index 23da9f026a..bac8faac44 100644
--- a/arch/AArch64/AArch64Mapping.c
+++ b/arch/AArch64/AArch64Mapping.c
@@ -2493,6 +2493,18 @@ void AArch64_set_detail_op_reg(MCInst *MI, unsigned OpNum, aarch64_reg Reg)
 	AArch64_inc_op_count(MI);
 }
 
+/// Check if the previous operand is a memory operand whose base register was
+/// just set, but which has no index and no displacement yet.
+/// This indicates the following immediate is this memory operand's
+/// displacement (e.g. the offset in `ldr x0, [x1, #8]`).
+static bool prev_is_mem_base(MCInst *MI)
+{
+	return AArch64_get_detail(MI)->op_count > 0 &&
+	       AArch64_get_detail_op(MI, -1)->type == AARCH64_OP_MEM &&
+	       AArch64_get_detail_op(MI, -1)->mem.index == AARCH64_REG_INVALID &&
+	       AArch64_get_detail_op(MI, -1)->mem.disp == 0;
+}
+
 /// Check if the previous operand is a memory operand
 /// with only the base register set AND if this base register
 /// is write-back.
@@ -2530,13 +2542,24 @@ void AArch64_set_detail_op_imm(MCInst *MI, unsigned OpNum,
 		}
 		return;
 	}
-	if (map_get_op_type(MI, OpNum) & CS_OP_MEM || prev_is_membase_wb(MI)) {
+	// An operand can be flagged as both immediate and memory
+	// (CS_OP_IMM | CS_OP_MEM). It is only stored as a memory displacement if
+	// a memory operand is actually being assembled, i.e. its base register
+	// was set right before this operand or the previous operand is a
+	// write-back base for a post-indexed offset. Otherwise the value is a
+	// standalone immediate (e.g. the PC-relative target of a literal load
+	// like `ldr x0, <label>`), which must not be truncated into the 32 bit
+	// memory displacement field.
+	if ((map_get_op_type(MI, OpNum) & CS_OP_MEM && prev_is_mem_base(MI)) ||
+	    prev_is_membase_wb(MI)) {
 		AArch64_set_detail_op_mem(MI, OpNum, Imm);
 		return;
 	}
 
-	CS_ASSERT_RET(!(map_get_op_type(MI, OpNum) & CS_OP_MEM));
-	CS_ASSERT_RET((map_get_op_type(MI, OpNum) & ~CS_OP_BOUND) == CS_OP_IMM);
+	// Operands flagged as memory only reach this point when they are not
+	// part of a memory operand currently being assembled (see above), so
+	// they are emitted as a plain immediate.
+	CS_ASSERT_RET(map_get_op_type(MI, OpNum) & CS_OP_IMM);
 	CS_ASSERT_RET(ImmType == AARCH64_OP_IMM || ImmType == AARCH64_OP_CIMM);
 
 	AArch64_get_detail_op(MI, 0)->type = ImmType;
diff --git a/tests/issues/issues.yaml b/tests/issues/issues.yaml
index e81ac8adf4..53038929ca 100644
--- a/tests/issues/issues.yaml
+++ b/tests/issues/issues.yaml
@@ -6646,3 +6646,22 @@ test_cases:
           regs_read: [ rax ]
           regs_write: [ sp ]
           groups: [ mode64 ]
+  -
+    input:
+      name: "AArch64 - #2878 - literal load target must not be truncated to 32 bits"
+      bytes: [ 0xa8, 0x79, 0x29, 0x58 ]
+      arch: "CS_ARCH_AARCH64"
+      options: [ CS_MODE_ARM, CS_OPT_DETAIL ]
+      address: 0x100c894d4
+    expected:
+      insns:
+      -
+        asm_text: "ldr x8, 0x100cdc408"
+        details:
+          aarch64:
+            operands:
+              -
+                type: AARCH64_OP_REG
+              -
+                type: AARCH64_OP_IMM
+                imm: 0x100cdc408