AZL-96894

Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c SH floating-point decoders such as opFADD, opFMUL, and opFSUB call setreg() and setregn() using shinfo.op.opcount without checking the fixed-size operands[] array. Repeated crafted instructions processed through csdisasmiter() or csdisasm() with CSARCHSH, CSMODESH2A or CSMODESH4A, CSMODESHFPU, and CSOPTDETAIL can increment the operand count beyond the 176-byte sh_info allocation and perform a four-byte heap buffer overflow write. The corruption can crash the process and may enable code execution depending on heap layout. This issue is fixed in version 6.0.0-Alpha10.