aboutsummaryrefslogtreecommitdiff
path: root/gas
diff options
context:
space:
mode:
authorAlan Modra <amodra@gmail.com>2014-06-16 10:33:26 +0930
committerAlan Modra <amodra@gmail.com>2014-06-16 12:30:53 +0930
commit6e210b4129b522c1a0b0c6dee24ee469d5020583 (patch)
tree26e63c5400f6e37904c85867e75cede355001ff0 /gas
parentee0738df021c42217828f02858c1f882a1546557 (diff)
downloadgdb-6e210b4129b522c1a0b0c6dee24ee469d5020583.zip
gdb-6e210b4129b522c1a0b0c6dee24ee469d5020583.tar.gz
gdb-6e210b4129b522c1a0b0c6dee24ee469d5020583.tar.bz2
Fix TIC54X buffer overruns
MALLOC_PERTURB_=1 results in "FAIL: c54x macros". * config/tc-tic54x.c (tic54x_mlib): Don't write garbage past end of archive to temp file. (tic54x_start_line_hook): Start scan for parallel on next line, not one char into next line (which may overrun the buffer).
Diffstat (limited to 'gas')
-rw-r--r--gas/ChangeLog7
-rw-r--r--gas/config/tc-tic54x.c6
2 files changed, 10 insertions, 3 deletions
diff --git a/gas/ChangeLog b/gas/ChangeLog
index 7f6ec03..7e39715 100644
--- a/gas/ChangeLog
+++ b/gas/ChangeLog
@@ -1,5 +1,12 @@
2014-06-16 Alan Modra <amodra@gmail.com>
+ * config/tc-tic54x.c (tic54x_mlib): Don't write garbage past
+ end of archive to temp file.
+ (tic54x_start_line_hook): Start scan for parallel on next line,
+ not one char into next line (which may overrun the buffer).
+
+2014-06-16 Alan Modra <amodra@gmail.com>
+
* config/tc-vax.c (md_apply_fix): Rewrite.
(tc_gen_reloc, vax_cons, vax_cons_fix_new): Style: Use NO_RELOC
define rather than the equivalent BFD_RELOC_NONE.
diff --git a/gas/config/tc-tic54x.c b/gas/config/tc-tic54x.c
index bba743c..c997297 100644
--- a/gas/config/tc-tic54x.c
+++ b/gas/config/tc-tic54x.c
@@ -2368,13 +2368,13 @@ tic54x_mlib (int ignore ATTRIBUTE_UNUSED)
FILE *ftmp;
/* We're not sure how big it is, but it will be smaller than "size". */
- bfd_bread (buf, size, mbfd);
+ size = bfd_bread (buf, size, mbfd);
/* Write to a temporary file, then use s_include to include it
a bit of a hack. */
ftmp = fopen (fname, "w+b");
fwrite ((void *) buf, size, 1, ftmp);
- if (buf[size - 1] != '\n')
+ if (size == 0 || buf[size - 1] != '\n')
fwrite ("\n", 1, 1, ftmp);
fclose (ftmp);
free (buf);
@@ -4777,7 +4777,7 @@ tic54x_start_line_hook (void)
line[endp - input_line_pointer] = 0;
/* Scan ahead for parallel insns. */
- parallel_on_next_line_hint = next_line_shows_parallel (endp + 1);
+ parallel_on_next_line_hint = next_line_shows_parallel (endp);
/* If within a macro, first process forced replacements. */
if (macro_level > 0)