From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-io1-xd35.google.com (mail-io1-xd35.google.com [IPv6:2607:f8b0:4864:20::d35]) by sourceware.org (Postfix) with ESMTPS id 0081B394FC35 for ; Thu, 17 Mar 2022 11:00:29 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 0081B394FC35 Received: by mail-io1-xd35.google.com with SMTP id r2so5408928iod.9 for ; Thu, 17 Mar 2022 04:00:29 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:subject:message-id:mime-version :content-disposition; bh=kAk1msxZqNYM7zJZDhzhco7/euzy6M6GKahR83/Fd9w=; b=khOMH2/5c6K52HoPtTn0eP3xnCLZsoK09T5nZfnrlMQK2XxHrrFhXJiCEEAw3kfqN1 liovQQqNO8Idrg+Yx259XPM3Beq+4neMxnjuoJS3TlF4v9DObsVQQvYY20aUErW7GMQz G6oqfASLxdwk2ishc1RHzExE+/adfAsQsQlmtPDbeQFWeIHhI1Jw2JMeQdgTCDz+FgtC alpwfJonA1GBvgzbWs3fVEt0uSSOuf3ir+YnVE0PNOKtvxLeI2yE+1YyE1+kihFcXhfl Fjinx+6eAUmEuBAixKSAS7eBTAIKibxGQYCyTd8sbII9kKKkMbtwscOfyz5Q3//LBJki M6rw== X-Gm-Message-State: AOAM530CnKjjeoEbzItunCOhoCdBX5jAkh+tBsHmKwdU1MsKk4pJL4kB dx9XBEL4v7Pl2QJLECBuGiT/AcXZSC0= X-Google-Smtp-Source: ABdhPJwdodICdhA46IUbAeb8NwVDPvzihMPeuFHF5Yk+yhVxtKwmmBKKycBjIdM+HetwHFJbAXh4Gw== X-Received: by 2002:a5e:8347:0:b0:646:2d18:ebfe with SMTP id y7-20020a5e8347000000b006462d18ebfemr1867396iom.145.1647514828722; Thu, 17 Mar 2022 04:00:28 -0700 (PDT) Received: from squeak.grove.modra.org (158.106.96.58.static.exetel.com.au. [58.96.106.158]) by smtp.gmail.com with ESMTPSA id y3-20020a92c983000000b002c7dce8329fsm1599786iln.72.2022.03.17.04.00.27 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 17 Mar 2022 04:00:28 -0700 (PDT) Received: by squeak.grove.modra.org (Postfix, from userid 1000) id 489561142F41; Thu, 17 Mar 2022 21:30:25 +1030 (ACDT) Date: Thu, 17 Mar 2022 21:30:25 +1030 From: Alan Modra To: binutils@sourceware.org Subject: asan: use of uninitialized value in buffer_and_nest Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Spam-Status: No, score=-3037.7 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on server2.sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Mar 2022 11:00:35 -0000 More occurences of the same as commit d12b8d620c6a. * macro.c (buffer_and_nest): Sanity check length in buffer before calling strncasecmp. diff --git a/gas/macro.c b/gas/macro.c index cbb9574fd66..2228f5b5404 100644 --- a/gas/macro.c +++ b/gas/macro.c @@ -184,9 +184,9 @@ buffer_and_nest (const char *from, const char *to, sb *ptr, { if (! flag_m68k_mri && ptr->ptr[i] == '.') i++; + size_t len = ptr->len - i; if (from == NULL) { - size_t len = ptr->len - i; if (len >= 5 && strncasecmp (ptr->ptr + i, "IREPC", 5) == 0) from_len = 5; else if (len >= 4 && strncasecmp (ptr->ptr + i, "IREP", 4) == 0) @@ -203,15 +203,16 @@ buffer_and_nest (const char *from, const char *to, sb *ptr, from_len = 0; } if ((from != NULL - ? strncasecmp (ptr->ptr + i, from, from_len) == 0 + ? (len >= from_len + && strncasecmp (ptr->ptr + i, from, from_len) == 0) : from_len > 0) - && (ptr->len == (i + from_len) + && (len == from_len || ! (is_part_of_name (ptr->ptr[i + from_len]) || is_name_ender (ptr->ptr[i + from_len])))) depth++; - if (ptr->len - i >= to_len + if (len >= to_len && strncasecmp (ptr->ptr + i, to, to_len) == 0 - && (ptr->len == (i + to_len) + && (len == to_len || ! (is_part_of_name (ptr->ptr[i + to_len]) || is_name_ender (ptr->ptr[i + to_len])))) { @@ -233,7 +234,7 @@ buffer_and_nest (const char *from, const char *to, sb *ptr, number when expanding the macro), and since for short macros we clearly prefer reporting the point of expansion anyway, there's not an obviously better fix here. */ - if (strncasecmp (ptr->ptr + i, "linefile", 8) == 0) + if (len >= 8 && strncasecmp (ptr->ptr + i, "linefile", 8) == 0) { char saved_eol_char = ptr->ptr[ptr->len]; -- Alan Modra Australia Development Lab, IBM