This patch fixes a flaw in the SREC parser which could cause a stack overflow

and potential secuiryt breach.

	PR binutils/17510
	* srec.c (srec_bad_byte): Increase size of buf to allow for
	negative values.
	(srec_scan): Use an unsigned char buffer to hold header bytes.

1 files changed, 2 insertions, 2 deletions

diff --git a/bfd/srec.c b/bfd/srec.c
index 9ed2080..5f9a546 100644
--- a/bfd/srec.c
+++ b/bfd/srec.c
@@ -246,7 +246,7 @@ srec_bad_byte (bfd *abfd,
     }
   else
     {
-      char buf[10];
+      char buf[40];
 
       if (! ISPRINT (c))
 	sprintf (buf, "\\%03o", (unsigned int) c);
@@ -452,7 +452,7 @@ srec_scan (bfd *abfd)
 	case 'S':
 	  {
 	    file_ptr pos;
-	    char hdr[3];
+	    unsigned char hdr[3];
 	    unsigned int bytes, min_bytes;
 	    bfd_vma address;
 	    bfd_byte *data;