Fix invalid strcpy on unterminated buffer

* read.c (do_repeat_with_expander): Use memmove instead of strcpy
on unterminated string buffer.

2 files changed, 7 insertions, 1 deletions

diff --git a/gas/ChangeLog b/gas/ChangeLog
index 366f4c1..5343503 100644
--- a/gas/ChangeLog
+++ b/gas/ChangeLog
@@ -1,3 +1,8 @@
+2018-08-21  Andreas Schwab  <schwab@suse.de>
+
+	* read.c (do_repeat_with_expander): Use memmove instead of strcpy
+	on unterminated string buffer.
+
 2018-08-21  Alan Modra  <amodra@gmail.com>
 
 	* config/tc-ppc.c (md_assemble): Delay counting of optional
diff --git a/gas/read.c b/gas/read.c
index 1f211b6..f011149 100644
--- a/gas/read.c
+++ b/gas/read.c
@@ -3117,7 +3117,8 @@ do_repeat_with_expander (size_t count,
 	  sub = strstr (processed.ptr, expander);
 	  len = sprintf (sub, "%lu", (unsigned long) count);
 	  gas_assert (len < 8);
-	  strcpy (sub + len, sub + 8);
+	  memmove (sub + len, sub + 8,
+		   processed.ptr + processed.len - (sub + 8));
 	  processed.len -= (8 - len);
 	  sb_add_sb (& many, & processed);
 	  sb_kill (& processed);