diff options
| author | Alan Modra <amodra@gmail.com> | 2023-03-02 08:12:00 +1030 |
|---|---|---|
| committer | Alan Modra <amodra@gmail.com> | 2023-03-02 08:16:02 +1030 |
| commit | 6e1ee99772d2f0c07b4a2c65f3c1593fbf55d9c1 (patch) | |
| tree | 730c7ae589555949719874d8587588fc4dc0938e | |
| parent | 40e7bdbddc8ba144ae90641be58d6ac939ba096b (diff) | |
| download | gdb-6e1ee99772d2f0c07b4a2c65f3c1593fbf55d9c1.zip gdb-6e1ee99772d2f0c07b4a2c65f3c1593fbf55d9c1.tar.gz gdb-6e1ee99772d2f0c07b4a2c65f3c1593fbf55d9c1.tar.bz2 | |
More bounds checking in macro_expand
* macro.c (macro_expand): Ensure input string buffer is not
read past end.
| -rw-r--r-- | gas/macro.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/gas/macro.c b/gas/macro.c index 74a1317..fae94ae 100644 --- a/gas/macro.c +++ b/gas/macro.c @@ -1120,7 +1120,7 @@ macro_expand (size_t idx, sb *in, macro_entry *m, sb *out) then the actual stuff. */ sb_reset (&t); idx = get_token (idx, in, &t); - if (in->ptr[idx] != '=') + if (idx >= in->len || in->ptr[idx] != '=') { err = _("confusion in formal parameters"); break; @@ -1184,7 +1184,7 @@ macro_expand (size_t idx, sb *in, macro_entry *m, sb *out) if (f->type != FORMAL_VARARG) idx = get_any_string (idx, in, &f->actual); - else + else if (idx < in->len) { sb_add_buffer (&f->actual, in->ptr + idx, in->len - idx); idx = in->len; @@ -1202,9 +1202,9 @@ macro_expand (size_t idx, sb *in, macro_entry *m, sb *out) idx = sb_skip_comma (idx, in); else { - if (in->ptr[idx] == ',') + if (idx < in->len && in->ptr[idx] == ',') ++idx; - if (ISWHITE (in->ptr[idx])) + if (idx < in->len && ISWHITE (in->ptr[idx])) break; } } |