From: Alan Modra <amodra@gmail.com>
To: binutils@sourceware.org
Subject: More bounds checking in macro_expand
Date: Thu, 2 Mar 2023 08:30:58 +1030 [thread overview]
Message-ID: <Y//LGl4CuJ+YN+i5@squeak.grove.modra.org> (raw)
* macro.c (macro_expand): Ensure input string buffer is not
read past end.
diff --git a/gas/macro.c b/gas/macro.c
index 74a1317cb11..fae94ae42c1 100644
--- a/gas/macro.c
+++ b/gas/macro.c
@@ -1120,7 +1120,7 @@ macro_expand (size_t idx, sb *in, macro_entry *m, sb *out)
then the actual stuff. */
sb_reset (&t);
idx = get_token (idx, in, &t);
- if (in->ptr[idx] != '=')
+ if (idx >= in->len || in->ptr[idx] != '=')
{
err = _("confusion in formal parameters");
break;
@@ -1184,7 +1184,7 @@ macro_expand (size_t idx, sb *in, macro_entry *m, sb *out)
if (f->type != FORMAL_VARARG)
idx = get_any_string (idx, in, &f->actual);
- else
+ else if (idx < in->len)
{
sb_add_buffer (&f->actual, in->ptr + idx, in->len - idx);
idx = in->len;
@@ -1202,9 +1202,9 @@ macro_expand (size_t idx, sb *in, macro_entry *m, sb *out)
idx = sb_skip_comma (idx, in);
else
{
- if (in->ptr[idx] == ',')
+ if (idx < in->len && in->ptr[idx] == ',')
++idx;
- if (ISWHITE (in->ptr[idx]))
+ if (idx < in->len && ISWHITE (in->ptr[idx]))
break;
}
}
--
Alan Modra
Australia Development Lab, IBM
reply other threads:[~2023-03-01 22:01 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Y//LGl4CuJ+YN+i5@squeak.grove.modra.org \
--to=amodra@gmail.com \
--cc=binutils@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).