Avoid undefined behaviour with signed expressions

	PR 17453
bfd/
	* libbfd.c (COERCE16, COERCE32, COERCE64): Use unsigned types.
	(EIGHT_GAZILLION): Delete.
binutils/
	* dwarf.c (read_leb128): Avoid signed overflow.
	(read_debug_line_header): Likewise.
gas/
	* config/tc-i386.c (fits_in_signed_long): Use unsigned param and
	expression to avoid signed overflow.
	(fits_in_signed_byte, fits_in_unsigned_byte, fits_in_unsigned_word,
	fits_in_signed_word, fits_in_unsigned_long): Similarly.
	* expr.c (operand <'-'>): Avoid signed overflow.
	* read.c (s_comm_internal): Likewise.

5 files changed, 26 insertions, 16 deletions

diff --git a/gas/ChangeLog b/gas/ChangeLog
index 5eb4813..1b4fda9 100644
--- a/gas/ChangeLog
+++ b/gas/ChangeLog
@@ -1,5 +1,15 @@
 2014-10-14  Alan Modra  <amodra@gmail.com>
 
+	PR 17453
+	* config/tc-i386.c (fits_in_signed_long): Use unsigned param and
+	expression to avoid signed overflow.
+	(fits_in_signed_byte, fits_in_unsigned_byte, fits_in_unsigned_word,
+	fits_in_signed_word, fits_in_unsigned_long): Similarly.
+	* expr.c (operand <'-'>): Avoid signed overflow.
+	* read.c (s_comm_internal): Likewise.
+
+2014-10-14  Alan Modra  <amodra@gmail.com>
+
 	* config/tc-sparc.c (sparc_md_end): Fix unused variable warnings.
 
 2014-10-09  Jose E. Marchesi  <jose.marchesi@oracle.com>
diff --git a/gas/config/tc-i386.c b/gas/config/tc-i386.c
index 68ca7e4..38e9781 100644
--- a/gas/config/tc-i386.c
+++ b/gas/config/tc-i386.c
@@ -1946,47 +1946,46 @@ mode_from_disp_size (i386_operand_type t)
 }
 
 static INLINE int
-fits_in_signed_byte (offsetT num)
+fits_in_signed_byte (addressT num)
 {
-  return (num >= -128) && (num <= 127);
+  return num + 0x80 <= 0xff;
 }
 
 static INLINE int
-fits_in_unsigned_byte (offsetT num)
+fits_in_unsigned_byte (addressT num)
 {
-  return (num & 0xff) == num;
+  return num <= 0xff;
 }
 
 static INLINE int
-fits_in_unsigned_word (offsetT num)
+fits_in_unsigned_word (addressT num)
 {
-  return (num & 0xffff) == num;
+  return num <= 0xffff;
 }
 
 static INLINE int
-fits_in_signed_word (offsetT num)
+fits_in_signed_word (addressT num)
 {
-  return (-32768 <= num) && (num <= 32767);
+  return num + 0x8000 <= 0xffff;
 }
 
 static INLINE int
-fits_in_signed_long (offsetT num ATTRIBUTE_UNUSED)
+fits_in_signed_long (addressT num ATTRIBUTE_UNUSED)
 {
 #ifndef BFD64
   return 1;
 #else
-  return (!(((offsetT) -1 << 31) & num)
-	  || (((offsetT) -1 << 31) & num) == ((offsetT) -1 << 31));
+  return num + 0x80000000 <= 0xffffffff;
 #endif
 }				/* fits_in_signed_long() */
 
 static INLINE int
-fits_in_unsigned_long (offsetT num ATTRIBUTE_UNUSED)
+fits_in_unsigned_long (addressT num ATTRIBUTE_UNUSED)
 {
 #ifndef BFD64
   return 1;
 #else
-  return (num & (((offsetT) 2 << 31) - 1)) == num;
+  return num <= 0xffffffff;
 #endif
 }				/* fits_in_unsigned_long() */
 
diff --git a/gas/expr.c b/gas/expr.c
index eb7255f..0ccfbd3 100644
--- a/gas/expr.c
+++ b/gas/expr.c
@@ -1021,7 +1021,8 @@ operand (expressionS *expressionP, enum expr_mode mode)
 	    /* input_line_pointer -> char after operand.  */
 	    if (c == '-')
 	      {
-		expressionP->X_add_number = - expressionP->X_add_number;
+		expressionP->X_add_number
+		  = - (addressT) expressionP->X_add_number;
 		/* Notice: '-' may overflow: no warning is given.
 		   This is compatible with other people's
 		   assemblers.  Sigh.  */
diff --git a/gas/read.c b/gas/read.c
index 2d5fdf1..9fd0335 100644
--- a/gas/read.c
+++ b/gas/read.c
@@ -1704,7 +1704,7 @@ s_comm_internal (int param,
 
   temp = get_absolute_expr (&exp);
   size = temp;
-  size &= ((offsetT) 2 << (stdoutput->arch_info->bits_per_address - 1)) - 1;
+  size &= ((addressT) 2 << (stdoutput->arch_info->bits_per_address - 1)) - 1;
   if (exp.X_op == O_absent)
     {
       as_bad (_("missing size expression"));
diff --git a/gas/write.c b/gas/write.c
index 0657b56..263b002 100644
--- a/gas/write.c
+++ b/gas/write.c
@@ -2309,7 +2309,7 @@ relax_align (register relax_addressT address,	/* Address now.  */
   relax_addressT mask;
   relax_addressT new_address;
 
-  mask = ~((~0) << alignment);
+  mask = ~((relax_addressT) ~0 << alignment);
   new_address = (address + mask) & (~mask);
 #ifdef LINKER_RELAXING_SHRINKS_ONLY
   if (linkrelax)