diff options
| -rw-r--r-- | bfd/ChangeLog | 6 | ||||
| -rw-r--r-- | bfd/bfd.c | 12 |
2 files changed, 12 insertions, 6 deletions
diff --git a/bfd/ChangeLog b/bfd/ChangeLog index 80d14ae..2362ca0 100644 --- a/bfd/ChangeLog +++ b/bfd/ChangeLog @@ -1,6 +1,12 @@ 2017-11-05 Alan Modra <amodra@gmail.com> PR 22397 + * bfd.c (_bfd_doprnt_scan): Check args index before storing, not + after. + +2017-11-05 Alan Modra <amodra@gmail.com> + + PR 22397 * bfd.c (union _bfd_doprnt_args): New. (PRINT_TYPE): Add FIELD arg. Take value from args. (_bfd_doprnt): Replace ap parameter with args. Adjust all @@ -974,10 +974,10 @@ _bfd_doprnt_scan (const char *format, union _bfd_doprnt_args *args) arg_index = *ptr - '1'; ptr += 2; } + if (arg_index >= 9) + abort (); args[arg_index].type = Int; arg_count++; - if (arg_count > 9) - abort (); } else /* Handle explicit numeric value. */ @@ -999,10 +999,10 @@ _bfd_doprnt_scan (const char *format, union _bfd_doprnt_args *args) arg_index = *ptr - '1'; ptr += 2; } + if (arg_index >= 9) + abort (); args[arg_index].type = Int; arg_count++; - if (arg_count > 9) - abort (); } else /* Handle explicit numeric value. */ @@ -1032,6 +1032,8 @@ _bfd_doprnt_scan (const char *format, union _bfd_doprnt_args *args) if ((int) arg_no < 0) arg_no = arg_count; + if (arg_no >= 9) + abort (); switch (ptr[-1]) { case 'd': @@ -1100,8 +1102,6 @@ _bfd_doprnt_scan (const char *format, union _bfd_doprnt_args *args) abort(); } arg_count++; - if (arg_count > 9) - abort (); } } |