diff options
| author | Alan Modra <amodra@gmail.com> | 2022-03-17 16:04:22 +1030 |
|---|---|---|
| committer | Alan Modra <amodra@gmail.com> | 2022-03-17 21:32:44 +1030 |
| commit | 4c5f3d0c9eb3ebe49f822bd1aabd3184f24998d8 (patch) | |
| tree | 6bd6631434075ec9859006d0274199fcd4c822d9 | |
| parent | 6109e902f1dd4124b5d399f9a8e3b6e123a706d4 (diff) | |
| download | gdb-4c5f3d0c9eb3ebe49f822bd1aabd3184f24998d8.zip gdb-4c5f3d0c9eb3ebe49f822bd1aabd3184f24998d8.tar.gz gdb-4c5f3d0c9eb3ebe49f822bd1aabd3184f24998d8.tar.bz2 | |
asan: use of uninitialized value in buffer_and_nest
More occurences of the same as commit d12b8d620c6a.
* macro.c (buffer_and_nest): Sanity check length in buffer
before calling strncasecmp.
| -rw-r--r-- | gas/macro.c | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/gas/macro.c b/gas/macro.c index cbb9574..2228f5b 100644 --- a/gas/macro.c +++ b/gas/macro.c @@ -184,9 +184,9 @@ buffer_and_nest (const char *from, const char *to, sb *ptr, { if (! flag_m68k_mri && ptr->ptr[i] == '.') i++; + size_t len = ptr->len - i; if (from == NULL) { - size_t len = ptr->len - i; if (len >= 5 && strncasecmp (ptr->ptr + i, "IREPC", 5) == 0) from_len = 5; else if (len >= 4 && strncasecmp (ptr->ptr + i, "IREP", 4) == 0) @@ -203,15 +203,16 @@ buffer_and_nest (const char *from, const char *to, sb *ptr, from_len = 0; } if ((from != NULL - ? strncasecmp (ptr->ptr + i, from, from_len) == 0 + ? (len >= from_len + && strncasecmp (ptr->ptr + i, from, from_len) == 0) : from_len > 0) - && (ptr->len == (i + from_len) + && (len == from_len || ! (is_part_of_name (ptr->ptr[i + from_len]) || is_name_ender (ptr->ptr[i + from_len])))) depth++; - if (ptr->len - i >= to_len + if (len >= to_len && strncasecmp (ptr->ptr + i, to, to_len) == 0 - && (ptr->len == (i + to_len) + && (len == to_len || ! (is_part_of_name (ptr->ptr[i + to_len]) || is_name_ender (ptr->ptr[i + to_len])))) { @@ -233,7 +234,7 @@ buffer_and_nest (const char *from, const char *to, sb *ptr, number when expanding the macro), and since for short macros we clearly prefer reporting the point of expansion anyway, there's not an obviously better fix here. */ - if (strncasecmp (ptr->ptr + i, "linefile", 8) == 0) + if (len >= 8 && strncasecmp (ptr->ptr + i, "linefile", 8) == 0) { char saved_eol_char = ptr->ptr[ptr->len]; |