diff options
| author | Chen Gang <gang.chen.5i5j@gmail.com> | 2014-10-15 09:48:47 +1030 |
|---|---|---|
| committer | Alan Modra <amodra@gmail.com> | 2014-10-15 09:56:54 +1030 |
| commit | 450ccef08d3a35300c9ebeee71df96b9c56ca0b0 (patch) | |
| tree | 64485f614e5f4669a0927025a62749998790bfca /gas/config/tc-tic4x.c | |
| parent | 45229ecbba96f9f07b3b80c1e3bbc93d38017c17 (diff) | |
| download | fsf-binutils-gdb-450ccef08d3a35300c9ebeee71df96b9c56ca0b0.zip fsf-binutils-gdb-450ccef08d3a35300c9ebeee71df96b9c56ca0b0.tar.gz fsf-binutils-gdb-450ccef08d3a35300c9ebeee71df96b9c56ca0b0.tar.bz2 | |
Fix memory overflow issue about strncat
If src contains n or more bytes, strncat() writes n+1 bytes to dest
(n from src plus the terminating null byte). Therefore, the size of
dest must be at least strlen(dest)+n+1.
* config/tc-tic4x.c (md_assemble): Correct strncat size.
Diffstat (limited to 'gas/config/tc-tic4x.c')
| -rw-r--r-- | gas/config/tc-tic4x.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/gas/config/tc-tic4x.c b/gas/config/tc-tic4x.c index 904a68c..dc82168 100644 --- a/gas/config/tc-tic4x.c +++ b/gas/config/tc-tic4x.c @@ -2456,7 +2456,7 @@ md_assemble (char *str) if (*s) /* Null terminate for hash_find. */ *s++ = '\0'; /* and skip past null. */ strcat (insn->name, "_"); - strncat (insn->name, str, TIC4X_NAME_MAX - strlen (insn->name)); + strncat (insn->name, str, TIC4X_NAME_MAX - 1 - strlen (insn->name)); insn->operands[insn->num_operands++].mode = M_PARALLEL; |