Invalid OF calculation - `sub`

[softsec-kaist]

Invalid OF calculation - `sub`

[ivg]

So, what I'm seeing here is that OF is cleared. The expression is just not simplified. In BAP 1.3 we have much better printer (that doesn't print unnecessary parenthesis), as well as better expression simplifier, e.g.,

 echo '\x28\xc0' | bap-mc --arch=x86 --show-bil --show-insn=asm
subb %al, %al
{
  v1 := low:8[EAX]
  EAX := extract:31:8[EAX].0
  CF := v1 < low:8[EAX]
  OF := high:1[v1 ^ low:8[EAX]]
  AF := 0x10 = (0x10 & (low:8[EAX] ^ v1 ^ low:8[EAX]))
  PF := ~low:1[let v2 = low:8[EAX] >> 4 ^ low:8[EAX] in
    let v2 = v2 >> 2 ^ v2 in
    v2 >> 1 ^ v2]
  SF := high:1[low:8[EAX]]
  ZF := 0 = low:8[EAX]
}

You may see that high:1[v1 ^ low:8[EAX]] is zero since v1 is equal to low:8[EAX] and xor of two equal values is 0, this the high bit of 0 is also a zero.

[soomin-kim]

Also in this case, like Issue #3, every statement should be executed sequentially so at the point of OF calculation, the lower 8 bit of EAX register is 0, not same as v1.
So if al contains a negative 8-bit width integer, OF should be 1 in BIL's semantics.