24 files changed, 226 insertions, 146 deletions

diff --git a/gas/ChangeLog b/gas/ChangeLog
index 9d601fd..53c3b3b 100644
--- a/gas/ChangeLog
+++ b/gas/ChangeLog
@@ -1,3 +1,29 @@
+2016-03-21  Nick Clifton  <nickc@redhat.com>
+
+	* atof-generic.c: Replace use of alloca with call to xmalloc.
+	* cgen.c: Likewise.
+	* dwarf2dbg.c: Likewise.
+	* macro.c: Likewise.
+	* remap.c: Likewise.
+	* stabs.c: Likewise.
+	* symbols.c: Likewise.
+	* config/obj-elf.c: Likewise.
+	* config/tc-aarch64.c: Likewise.
+	* config/tc-arc.c: Likewise.
+	* config/tc-arm.c: Likewise.
+	* config/tc-avr.c: Likewise.
+	* config/tc-ia64.c: Likewise.
+	* config/tc-mips.c: Likewise.
+	* config/tc-msp430.c: Likewise.
+	* config/tc-nds32.c: Likewise.
+	* config/tc-ppc.c: Likewise.
+	* config/tc-sh.c: Likewise.
+	* config/tc-tic30.c: Likewise.
+	* config/tc-tic54x.c: Likewise.
+	* config/tc-xstormy16.c: Likewise.
+	* config/te-vms.c: Likewise.
+	* configure: Regenerate.
+
 2016-03-20  Trevor Saunders  <tbsaunde+binutils@tbsaunde.org>
 
 	* tc-i386.c (f32_1): Change type to unsigned char[].
diff --git a/gas/atof-generic.c b/gas/atof-generic.c
index 2041810..b1deec0 100644
--- a/gas/atof-generic.c
+++ b/gas/atof-generic.c
@@ -305,6 +305,8 @@ atof_generic (/* return pointer to just AFTER number we read.  */
     {
       int count;		/* Number of useful digits left to scan.  */
 
+      LITTLENUM_TYPE *temporary_binary_low = NULL;
+      LITTLENUM_TYPE *power_binary_low = NULL;
       LITTLENUM_TYPE *digits_binary_low;
       unsigned int precision;
       unsigned int maximum_useful_digits;
@@ -362,7 +364,7 @@ atof_generic (/* return pointer to just AFTER number we read.  */
 	* sizeof (LITTLENUM_TYPE);
 
       digits_binary_low = (LITTLENUM_TYPE *)
-	alloca (size_of_digits_in_chars);
+	xmalloc (size_of_digits_in_chars);
 
       memset ((char *) digits_binary_low, '\0', size_of_digits_in_chars);
 
@@ -455,13 +457,11 @@ atof_generic (/* return pointer to just AFTER number we read.  */
 	 * giving return_binary_mantissa and return_binary_exponent.
 	 */
 
-	LITTLENUM_TYPE *power_binary_low;
 	int decimal_exponent_is_negative;
 	/* This refers to the "-56" in "12.34E-56".  */
 	/* FALSE: decimal_exponent is positive (or 0) */
 	/* TRUE:  decimal_exponent is negative */
 	FLONUM_TYPE temporary_flonum;
-	LITTLENUM_TYPE *temporary_binary_low;
 	unsigned int size_of_power_in_littlenums;
 	unsigned int size_of_power_in_chars;
 
@@ -479,8 +479,9 @@ atof_generic (/* return pointer to just AFTER number we read.  */
 	size_of_power_in_chars = size_of_power_in_littlenums
 	  * sizeof (LITTLENUM_TYPE) + 2;
 
-	power_binary_low = (LITTLENUM_TYPE *) alloca (size_of_power_in_chars);
-	temporary_binary_low = (LITTLENUM_TYPE *) alloca (size_of_power_in_chars);
+	power_binary_low = (LITTLENUM_TYPE *) xmalloc (size_of_power_in_chars);
+	temporary_binary_low = (LITTLENUM_TYPE *) xmalloc (size_of_power_in_chars);
+
 	memset ((char *) power_binary_low, '\0', size_of_power_in_chars);
 	*power_binary_low = 1;
 	power_of_10_flonum.exponent = 0;
@@ -571,7 +572,6 @@ atof_generic (/* return pointer to just AFTER number we read.  */
 	  (void) putchar ('\n');
 #endif
 	}
-
       }
 
       /*
@@ -585,6 +585,11 @@ atof_generic (/* return pointer to just AFTER number we read.  */
       /* Assert sign of the number we made is '+'.  */
       address_of_generic_floating_point_number->sign = digits_sign_char;
 
+      if (temporary_binary_low)
+	free (temporary_binary_low);
+      if (power_binary_low)
+	free (power_binary_low);
+      free (digits_binary_low);
     }
   return return_value;
 }
diff --git a/gas/cgen.c b/gas/cgen.c
index 42d547b..bf8611f 100644
--- a/gas/cgen.c
+++ b/gas/cgen.c
@@ -891,7 +891,6 @@ gas_cgen_md_apply_fix (fixP, valP, seg)
       const CGEN_OPERAND *operand = cgen_operand_lookup_by_num (cd, opindex);
       const char *errmsg;
       bfd_reloc_code_real_type reloc_type;
-      CGEN_FIELDS *fields = alloca (CGEN_CPU_SIZEOF_FIELDS (cd));
       const CGEN_INSN *insn = fixP->fx_cgen.insn;
 #ifdef OBJ_COMPLEX_RELC
       int start;
@@ -927,6 +926,8 @@ gas_cgen_md_apply_fix (fixP, valP, seg)
 	     finish the job.  Testing for pcrel is a temporary hack.  */
 	  || fixP->fx_pcrel)
 	{
+	  CGEN_FIELDS *fields = xmalloc (CGEN_CPU_SIZEOF_FIELDS (cd));
+
 	  CGEN_CPU_SET_FIELDS_BITSIZE (cd) (fields, CGEN_INSN_BITSIZE (insn));
 	  CGEN_CPU_SET_VMA_OPERAND (cd) (cd, opindex, fields, (bfd_vma) value);
 
@@ -950,6 +951,8 @@ gas_cgen_md_apply_fix (fixP, valP, seg)
 #endif
 	  if (errmsg)
 	    as_bad_where (fixP->fx_file, fixP->fx_line, "%s", errmsg);
+
+	  free (fields);
 	}
 
       if (fixP->fx_done)
diff --git a/gas/config/obj-elf.c b/gas/config/obj-elf.c
index e8af394..bacaca3 100644
--- a/gas/config/obj-elf.c
+++ b/gas/config/obj-elf.c
@@ -1607,7 +1607,7 @@ obj_elf_vendor_attribute (int vendor)
       if (i == 0)
 	goto bad;
 
-      name = (char *) alloca (i + 1);
+      name = xmalloc (i + 1);
       memcpy (name, s, i);
       name[i] = '\0';
 
@@ -1620,8 +1620,10 @@ obj_elf_vendor_attribute (int vendor)
 	{
 	  as_bad (_("Attribute name not recognised: %s"), name);
 	  ignore_rest_of_line ();
+	  free (name);
 	  return 0;
 	}
+      free (name);
     }
 
   type = _bfd_elf_obj_attrs_arg_type (stdoutput, vendor, tag);
@@ -2085,9 +2087,7 @@ adjust_stab_sections (bfd *abfd, asection *sec, void *xxx ATTRIBUTE_UNUSED)
   if (!strcmp ("str", sec->name + strlen (sec->name) - 3))
     return;
 
-  name = (char *) alloca (strlen (sec->name) + 4);
-  strcpy (name, sec->name);
-  strcat (name, "str");
+  name = concat (sec->name, "str", NULL);
   strsec = bfd_get_section_by_name (abfd, name);
   if (strsec)
     strsz = bfd_section_size (abfd, strsec);
@@ -2100,6 +2100,7 @@ adjust_stab_sections (bfd *abfd, asection *sec, void *xxx ATTRIBUTE_UNUSED)
 
   bfd_h_put_16 (abfd, nsyms, p + 6);
   bfd_h_put_32 (abfd, strsz, p + 8);
+  free (name);
 }
 
 #ifdef NEED_ECOFF_DEBUG
diff --git a/gas/config/tc-aarch64.c b/gas/config/tc-aarch64.c
index b06c46a..64a732b 100644
--- a/gas/config/tc-aarch64.c
+++ b/gas/config/tc-aarch64.c
@@ -1241,7 +1241,7 @@ create_register_alias (char *newname, char *p)
   nlen = strlen (newname);
 #endif
 
-  nbuf = alloca (nlen + 1);
+  nbuf = xmalloc (nlen + 1);
   memcpy (nbuf, newname, nlen);
   nbuf[nlen] = '\0';
 
@@ -1265,7 +1265,10 @@ create_register_alias (char *newname, char *p)
 	     the artificial FOO alias because it has already been created by the
 	     first .req.  */
 	  if (insert_reg_alias (nbuf, old->number, old->type) == NULL)
-	    return TRUE;
+	    {
+	      free (nbuf);
+	      return TRUE;
+	    }
 	}
 
       for (p = nbuf; *p; p++)
@@ -1275,6 +1278,7 @@ create_register_alias (char *newname, char *p)
 	insert_reg_alias (nbuf, old->number, old->type);
     }
 
+  free (nbuf);
   return TRUE;
 }
 
diff --git a/gas/config/tc-arc.c b/gas/config/tc-arc.c
index 0e92c55..1431e6d 100644
--- a/gas/config/tc-arc.c
+++ b/gas/config/tc-arc.c
@@ -2894,7 +2894,7 @@ md_parse_option (int c, char *arg ATTRIBUTE_UNUSED)
     case OPTION_MCPU:
       {
 	int i;
-	char *s = alloca (strlen (arg) + 1);
+	char *s = xmalloc (strlen (arg) + 1);
 
 	{
 	  char *t = s;
@@ -2907,7 +2907,7 @@ md_parse_option (int c, char *arg ATTRIBUTE_UNUSED)
 
 	for (i = 0; cpu_types[i].name; ++i)
 	  {
-	    if (!strcmp (cpu_types[i].name, s))
+	    if (strcmp (cpu_types[i].name, s) == 0)
 	      {
 		arc_target      = cpu_types[i].flags;
 		arc_target_name = cpu_types[i].name;
@@ -2921,9 +2921,8 @@ md_parse_option (int c, char *arg ATTRIBUTE_UNUSED)
 	  }
 
 	if (!cpu_types[i].name)
-	  {
-	    as_fatal (_("unknown architecture: %s\n"), arg);
-	  }
+	  as_fatal (_("unknown architecture: %s\n"), arg);
+	free (s);
 	break;
       }
 
diff --git a/gas/config/tc-arm.c b/gas/config/tc-arm.c
index 5b3cf59..4cc808d 100644
--- a/gas/config/tc-arm.c
+++ b/gas/config/tc-arm.c
@@ -2255,7 +2255,7 @@ create_register_alias (char * newname, char *p)
   nlen = strlen (newname);
 #endif
 
-  nbuf = (char *) alloca (nlen + 1);
+  nbuf = xmalloc (nlen + 1);
   memcpy (nbuf, newname, nlen);
   nbuf[nlen] = '\0';
 
@@ -2279,7 +2279,10 @@ create_register_alias (char * newname, char *p)
 	     the artificial FOO alias because it has already been created by the
 	     first .req.  */
 	  if (insert_reg_alias (nbuf, old->number, old->type) == NULL)
-	    return TRUE;
+	    {
+	      free (nbuf);
+	      return TRUE;
+	    }
 	}
 
       for (p = nbuf; *p; p++)
@@ -2289,6 +2292,7 @@ create_register_alias (char * newname, char *p)
 	insert_reg_alias (nbuf, old->number, old->type);
     }
 
+  free (nbuf);
   return TRUE;
 }
 
@@ -2416,7 +2420,7 @@ create_neon_reg_alias (char *newname, char *p)
   namelen = strlen (newname);
 #endif
 
-  namebuf = (char *) alloca (namelen + 1);
+  namebuf = xmalloc (namelen + 1);
   strncpy (namebuf, newname, namelen);
   namebuf[namelen] = '\0';
 
@@ -2439,6 +2443,7 @@ create_neon_reg_alias (char *newname, char *p)
     insert_neon_reg_alias (namebuf, basereg->number, basetype,
 			   typeinfo.defined != 0 ? &typeinfo : NULL);
 
+  free (namebuf);
   return TRUE;
 }
 
@@ -2754,8 +2759,9 @@ find_real_start (symbolS * symbolP)
   if (S_IS_LOCAL (symbolP) || name[0] == '.')
     return symbolP;
 
-  real_start = ACONCAT ((STUB_NAME, name, NULL));
+  real_start = concat (STUB_NAME, name, NULL);
   new_target = symbol_find (real_start);
+  free (real_start);
 
   if (new_target == NULL)
     {
@@ -3529,7 +3535,8 @@ s_arm_elf_cons (int nbytes)
 		     XXX Surely there is a cleaner way to do this.  */
 		  char *p = input_line_pointer;
 		  int offset;
-		  char *save_buf = (char *) alloca (input_line_pointer - base);
+		  char *save_buf = xmalloc (input_line_pointer - base);
+
 		  memcpy (save_buf, base, input_line_pointer - base);
 		  memmove (base + (input_line_pointer - before_reloc),
 			   base, before_reloc - base);
@@ -3543,6 +3550,7 @@ s_arm_elf_cons (int nbytes)
 		  memset (p, 0, nbytes);
 		  fix_new_exp (frag_now, p - frag_now->fr_literal + offset,
 			       size, &exp, 0, (enum bfd_reloc_code_real) reloc);
+		  free (save_buf);
 		}
 	    }
 	}
@@ -14852,13 +14860,15 @@ do_neon_addsub_if_i (void)
 static void
 neon_exchange_operands (void)
 {
-  void *scratch = alloca (sizeof (inst.operands[0]));
   if (inst.operands[1].present)
     {
+      void *scratch = xmalloc (sizeof (inst.operands[0]));
+
       /* Swap operands[1] and operands[2].  */
       memcpy (scratch, &inst.operands[1], sizeof (inst.operands[0]));
       inst.operands[1] = inst.operands[2];
       memcpy (&inst.operands[2], scratch, sizeof (inst.operands[0]));
+      free (scratch);
     }
   else
     {
diff --git a/gas/config/tc-avr.c b/gas/config/tc-avr.c
index 69881b7..9bd164e 100644
--- a/gas/config/tc-avr.c
+++ b/gas/config/tc-avr.c
@@ -562,7 +562,7 @@ md_parse_option (int c, char *arg)
     case OPTION_MMCU:
       {
 	int i;
-	char *s = alloca (strlen (arg) + 1);
+	char *s = xmalloc (strlen (arg) + 1);
 
 	{
 	  char *t = s;
@@ -577,6 +577,7 @@ md_parse_option (int c, char *arg)
 	  if (strcmp (mcu_types[i].name, s) == 0)
 	    break;
 
+	free (s);
 	if (!mcu_types[i].name)
 	  {
 	    show_mcu_list (stderr);
@@ -587,12 +588,12 @@ md_parse_option (int c, char *arg)
 	   type - this for allows passing -mmcu=... via gcc ASM_SPEC as well
 	   as .arch ... in the asm output at the same time.  */
 	if (avr_mcu == &default_mcu || avr_mcu->mach == mcu_types[i].mach)
-      {
-        specified_mcu.name = mcu_types[i].name;
-        specified_mcu.isa  |= mcu_types[i].isa;
-        specified_mcu.mach = mcu_types[i].mach;
-        avr_mcu = &specified_mcu;
-      }
+	  {
+	    specified_mcu.name = mcu_types[i].name;
+	    specified_mcu.isa  |= mcu_types[i].isa;
+	    specified_mcu.mach = mcu_types[i].mach;
+	    avr_mcu = &specified_mcu;
+	  }
 	else
 	  as_fatal (_("redefinition of mcu type `%s' to `%s'"),
 		    avr_mcu->name, mcu_types[i].name);
diff --git a/gas/config/tc-ia64.c b/gas/config/tc-ia64.c
index e43a7f9..c2f7372 100644
--- a/gas/config/tc-ia64.c
+++ b/gas/config/tc-ia64.c
@@ -3566,7 +3566,6 @@ start_unwind_section (const segT text_seg, int sec_index)
   char *sec_name;
   const char *prefix = special_section_name [sec_index];
   const char *suffix;
-  size_t prefix_len, suffix_len, sec_name_len;
 
   sec_text_name = segment_name (text_seg);
   text_name = sec_text_name;
@@ -3590,20 +3589,13 @@ start_unwind_section (const segT text_seg, int sec_index)
       suffix += sizeof (".gnu.linkonce.t.") - 1;
     }
 
-  prefix_len = strlen (prefix);
-  suffix_len = strlen (suffix);
-  sec_name_len = prefix_len + suffix_len;
-  sec_name = alloca (sec_name_len + 1);
-  memcpy (sec_name, prefix, prefix_len);
-  memcpy (sec_name + prefix_len, suffix, suffix_len);
-  sec_name [sec_name_len] = '\0';
+  sec_name = concat (prefix, suffix, NULL);
 
   /* Handle COMDAT group.  */
   if ((text_seg->flags & SEC_LINK_ONCE) != 0
       && (elf_section_flags (text_seg) & SHF_GROUP) != 0)
     {
       char *section;
-      size_t len, group_name_len;
       const char *group_name = elf_group_name (text_seg);
 
       if (group_name == NULL)
@@ -3611,22 +3603,14 @@ start_unwind_section (const segT text_seg, int sec_index)
 	  as_bad (_("Group section `%s' has no group signature"),
 		  sec_text_name);
 	  ignore_rest_of_line ();
+	  free (sec_name);
 	  return;
 	}
-      /* We have to construct a fake section directive. */
-      group_name_len = strlen (group_name);
-      len = (sec_name_len
-	     + 16			/* ,"aG",@progbits,  */
-	     + group_name_len		/* ,group_name  */
-	     + 7);			/* ,comdat  */
-
-      section = alloca (len + 1);
-      memcpy (section, sec_name, sec_name_len);
-      memcpy (section + sec_name_len, ",\"aG\",@progbits,", 16);
-      memcpy (section + sec_name_len + 16, group_name, group_name_len);
-      memcpy (section + len - 7, ",comdat", 7);
-      section [len] = '\0';
+
+      /* We have to construct a fake section directive.  */
+      section = concat (sec_name, ",\"aG\",@progbits,", group_name, ",comdat", NULL);
       set_section (section);
+      free (section);
     }
   else
     {
@@ -3636,6 +3620,7 @@ start_unwind_section (const segT text_seg, int sec_index)
     }
 
   elf_linked_to_section (now_seg) = text_seg;
+  free (sec_name);
 }
 
 static void
@@ -8078,8 +8063,7 @@ ia64_parse_name (char *name, expressionS *e, char *nextcharP)
 	}
     }
 
-  end = alloca (strlen (name) + 1);
-  strcpy (end, name);
+  end = xstrdup (name);
   name = ia64_canonicalize_symbol_name (end);
   if ((dr = hash_find (md.dynreg_hash, name)))
     {
@@ -8089,8 +8073,10 @@ ia64_parse_name (char *name, expressionS *e, char *nextcharP)
 	 bits.  */
       e->X_op = O_register;
       e->X_add_number = dr->base | (dr->num_regs << 16);
+      free (end);
       return 1;
     }
+  free (end);
   return 0;
 }
 
diff --git a/gas/config/tc-mips.c b/gas/config/tc-mips.c
index 4657ce2..d089362 100644
--- a/gas/config/tc-mips.c
+++ b/gas/config/tc-mips.c
@@ -2420,9 +2420,8 @@ set_insn_error_ss (int argnum, const char *msg, const char *s1, const char *s2)
 static void
 report_insn_error (const char *str)
 {
-  const char *msg;
+  const char *msg = concat (insn_error.msg, " `%s'", NULL);
 
-  msg = ACONCAT ((insn_error.msg, " `%s'", NULL));
   switch (insn_error.format)
     {
     case ERR_FMT_PLAIN:
@@ -2437,6 +2436,8 @@ report_insn_error (const char *str)
       as_bad (msg, insn_error.u.ss[0], insn_error.u.ss[1], str);
       break;
     }
+
+  free ((char *) msg);
 }
 
 /* Initialize vr4120_conflicts.  There is a bit of duplication here:
@@ -13530,14 +13531,14 @@ mips_lookup_insn (struct hash_control *hash, const char *start,
   struct mips_opcode *insn;
 
   /* Make a copy of the instruction so that we can fiddle with it.  */
-  name = alloca (length + 1);
+  name = xmalloc (length + 1);
   memcpy (name, start, length);
   name[length] = '\0';
 
   /* Look up the instruction as-is.  */
   insn = (struct mips_opcode *) hash_find (hash, name);
   if (insn)
-    return insn;
+    goto end;
 
   dot = strchr (name, '.');
   if (dot && dot[1])
@@ -13552,7 +13553,7 @@ mips_lookup_insn (struct hash_control *hash, const char *start,
 	  if (insn && (insn->pinfo2 & INSN2_VU0_CHANNEL_SUFFIX) != 0)
 	    {
 	      *opcode_extra |= mask << mips_vu0_channel_mask.lsb;
-	      return insn;
+	      goto end;
 	    }
 	}
     }
@@ -13577,12 +13578,15 @@ mips_lookup_insn (struct hash_control *hash, const char *start,
 	  if (insn)
 	    {
 	      forced_insn_length = suffix;
-	      return insn;
+	      goto end;
 	    }
 	}
     }
 
-  return NULL;
+  insn = NULL;
+ end:
+  free (name);
+  return insn;
 }
 
 /* Assemble an instruction into its binary format.  If the instruction
diff --git a/gas/config/tc-msp430.c b/gas/config/tc-msp430.c
index eb7df08..5004362 100644
--- a/gas/config/tc-msp430.c
+++ b/gas/config/tc-msp430.c
@@ -698,7 +698,7 @@ static unsigned int silicon_errata_warn = 0;
 static void
 msp430_set_arch (int option)
 {
-  char *str = (char *) alloca (32);	/* 32 for good measure.  */
+  char str[32];	/* 32 for good measure.  */
 
   input_line_pointer = extract_word (input_line_pointer, str, 32);
 
diff --git a/gas/config/tc-nds32.c b/gas/config/tc-nds32.c
index 774c470..66b8136 100644
--- a/gas/config/tc-nds32.c
+++ b/gas/config/tc-nds32.c
@@ -5141,6 +5141,7 @@ void
 md_assemble (char *str)
 {
   struct nds32_asm_insn insn;
+  expressionS expr;
   char *out;
   struct nds32_pseudo_opcode *popcode;
   const struct nds32_field *fld = NULL;
@@ -5176,7 +5177,7 @@ md_assemble (char *str)
     }
 
   label_exist = 0;
-  insn.info = (expressionS *) alloca (sizeof (expressionS));
+  insn.info = & expr;
   asm_desc.result = NASM_OK;
   nds32_assemble (&asm_desc, &insn, str);
 
diff --git a/gas/config/tc-ppc.c b/gas/config/tc-ppc.c
index 02cbb95..64a35a0 100644
--- a/gas/config/tc-ppc.c
+++ b/gas/config/tc-ppc.c
@@ -3523,7 +3523,7 @@ ppc_macro (char *str, const struct powerpc_macro *macro)
     }
 
   /* Put the string together.  */
-  complete = s = (char *) alloca (len + 1);
+  complete = s = (char *) xmalloc (len + 1);
   format = macro->format;
   while (*format != '\0')
     {
@@ -3541,6 +3541,7 @@ ppc_macro (char *str, const struct powerpc_macro *macro)
 
   /* Assemble the constructed instruction.  */
   md_assemble (complete);
+  free (complete);
 }
 
 #ifdef OBJ_ELF
diff --git a/gas/config/tc-sh.c b/gas/config/tc-sh.c
index 8f04c59..1bb6d71 100644
--- a/gas/config/tc-sh.c
+++ b/gas/config/tc-sh.c
@@ -2292,7 +2292,6 @@ build_relax (sh_opcode_info *opcode, sh_operand_info *op)
 static char *
 insert_loop_bounds (char *output, sh_operand_info *operand)
 {
-  char *name;
   symbolS *end_sym;
 
   /* Since the low byte of the opcode will be overwritten by the reloc, we
@@ -2305,6 +2304,7 @@ insert_loop_bounds (char *output, sh_operand_info *operand)
   if (sh_relax)
     {
       static int count = 0;
+      char name[11];
 
       /* If the last loop insn is a two-byte-insn, it is in danger of being
 	 swapped with the insn after it.  To prevent this, create a new
@@ -2313,7 +2313,6 @@ insert_loop_bounds (char *output, sh_operand_info *operand)
 	 right in the middle, but four byte insns are not swapped anyways.  */
       /* A REPEAT takes 6 bytes.  The SH has a 32 bit address space.
 	 Hence a 9 digit number should be enough to count all REPEATs.  */
-      name = alloca (11);
       sprintf (name, "_R%x", count++ & 0x3fffffff);
       end_sym = symbol_new (name, undefined_section, 0, &zero_address_frag);
       /* Make this a local symbol.  */
diff --git a/gas/config/tc-tic30.c b/gas/config/tc-tic30.c
index e069052..1853d8d 100644
--- a/gas/config/tc-tic30.c
+++ b/gas/config/tc-tic30.c
@@ -399,7 +399,6 @@ static operand *
 tic30_operand (char *token)
 {
   unsigned int count;
-  char ind_buffer[strlen (token)];
   operand *current_op;
 
   debug ("In tic30_operand with %s\n", token);
@@ -463,6 +462,9 @@ tic30_operand (char *token)
       int disp_number = 0;
       int buffer_posn = 1;
       ind_addr_type *ind_addr_op;
+      char * ind_buffer;
+
+      ind_buffer = xmalloc (strlen (token));
 
       debug ("Found indirect reference\n");
       ind_buffer[0] = *token;
@@ -480,11 +482,13 @@ tic30_operand (char *token)
 	      if (found_ar)
 		{
 		  as_bad (_("More than one AR register found in indirect reference"));
+		  free (ind_buffer);
 		  return NULL;
 		}
 	      if (*(token + count + 1) < '0' || *(token + count + 1) > '7')
 		{
 		  as_bad (_("Illegal AR register in indirect reference"));
+		  free (ind_buffer);
 		  return NULL;
 		}
 	      ar_number = *(token + count + 1) - '0';
@@ -505,6 +509,7 @@ tic30_operand (char *token)
 		  if (found_disp)
 		    {
 		      as_bad (_("More than one displacement found in indirect reference"));
+		      free (ind_buffer);
 		      return NULL;
 		    }
 		  count++;
@@ -513,6 +518,7 @@ tic30_operand (char *token)
 		      if (!is_digit_char (*(token + count)))
 			{
 			  as_bad (_("Invalid displacement in indirect reference"));
+			  free (ind_buffer);
 			  return NULL;
 			}
 		      disp[disp_posn++] = *(token + (count++));
@@ -530,6 +536,7 @@ tic30_operand (char *token)
       if (!found_ar)
 	{
 	  as_bad (_("AR register not found in indirect reference"));
+	  free (ind_buffer);
 	  return NULL;
 	}
 
@@ -546,18 +553,21 @@ tic30_operand (char *token)
 	    {
 	      /* Maybe an implied displacement of 1 again.  */
 	      as_bad (_("required displacement wasn't given in indirect reference"));
-	      return 0;
+	      free (ind_buffer);
+	      return NULL;
 	    }
 	}
       else
 	{
 	  as_bad (_("illegal indirect reference"));
+	  free (ind_buffer);
 	  return NULL;
 	}
 
       if (found_disp && (disp_number < 0 || disp_number > 255))
 	{
 	  as_bad (_("displacement must be an unsigned 8-bit number"));
+	  free (ind_buffer);
 	  return NULL;
 	}
 
@@ -565,6 +575,7 @@ tic30_operand (char *token)
       current_op->indirect.disp = disp_number;
       current_op->indirect.ARnum = ar_number;
       current_op->op_type = Indirect;
+      free (ind_buffer);
     }
   else
     {
diff --git a/gas/config/tc-tic54x.c b/gas/config/tc-tic54x.c
index e071f95..1524cd3 100644
--- a/gas/config/tc-tic54x.c
+++ b/gas/config/tc-tic54x.c
@@ -322,7 +322,6 @@ tic54x_asg (int x ATTRIBUTE_UNUSED)
   int c;
   char *name;
   char *str;
-  char *tmp;
   int quoted = *input_line_pointer == '"';
 
   ILLEGAL_WITHIN_STRUCT ();
@@ -360,12 +359,8 @@ tic54x_asg (int x ATTRIBUTE_UNUSED)
       return;
     }
 
-  tmp = xmalloc (strlen (str) + 1);
-  strcpy (tmp, str);
-  str = tmp;
-  tmp = xmalloc (strlen (name) + 1);
-  strcpy (tmp, name);
-  name = tmp;
+  str = xstrdup (str);
+  name = xstrdup (name);
   subsym_create_or_replace (name, str);
   (void) restore_line_pointer (c);
   demand_empty_rest_of_line ();
@@ -549,21 +544,16 @@ stag_add_field_symbols (struct stag *stag,
 			symbolS *rootsym,
 			const char *root_stag_name)
 {
-  char prefix[strlen (path) + 2];
+  char * prefix;
   struct stag_field *field = stag->field;
 
   /* Construct a symbol for every field contained within this structure
      including fields within structure fields.  */
-  strcpy (prefix, path);
-  if (*path)
-    strcat (prefix, ".");
+  prefix = concat (path, *path ? "." : "", NULL);
 
   while (field != NULL)
     {
-      int len = strlen (prefix) + strlen (field->name) + 2;
-      char *name = xmalloc (len);
-      strcpy (name, prefix);
-      strcat (name, field->name);
+      char *name = concat (prefix, field->name, NULL);
 
       if (rootsym == NULL)
 	{
@@ -577,12 +567,10 @@ stag_add_field_symbols (struct stag *stag,
 	}
       else
 	{
-	  char *replacement = xmalloc (strlen (name)
-				       + strlen (stag->name) + 2);
-	  strcpy (replacement, S_GET_NAME (rootsym));
-	  strcat (replacement, "+");
-	  strcat (replacement, root_stag_name);
-	  strcat (replacement, name + strlen (S_GET_NAME (rootsym)));
+	  char *replacement;
+
+	  replacement = concat (S_GET_NAME (rootsym), "+", root_stag_name,
+				name + strlen (S_GET_NAME (rootsym)), NULL);
 	  hash_insert (subsym_hash[0], name, replacement);
 	}
 
@@ -593,7 +581,9 @@ stag_add_field_symbols (struct stag *stag,
 				field->offset,
 				rootsym, root_stag_name);
       field = field->next;
+      free (name);
     }
+  free (prefix);
 }
 
 /* Keep track of stag fields so that when structures are nested we can add the
@@ -695,11 +685,12 @@ tic54x_struct (int arg)
     }
   else
     {
-      char label[strlen (S_GET_NAME (line_label)) + 1];
-      strcpy (label, S_GET_NAME (line_label));
-      current_stag->sym = symbol_new (label, absolute_section,
+      char * label = xstrdup (S_GET_NAME (line_label));
+      current_stag->sym = symbol_new (label,
+				      absolute_section,
 				      (valueT) abs_section_offset,
 				      &zero_address_frag);
+      free (label);
     }
   current_stag->name = S_GET_NAME (current_stag->sym);
   SF_SET_LOCAL (current_stag->sym);
@@ -803,9 +794,9 @@ tic54x_tag (int ignore ATTRIBUTE_UNUSED)
     }
   else
     {
-      char label[strlen (S_GET_NAME (line_label)) + 1];
+      char * label;
 
-      strcpy (label, S_GET_NAME (line_label));
+      label = xstrdup (S_GET_NAME (line_label));
       if (current_stag != NULL)
 	stag_add_field (current_stag, label,
 			abs_section_offset - S_GET_VALUE (current_stag->sym),
@@ -818,11 +809,13 @@ tic54x_tag (int ignore ATTRIBUTE_UNUSED)
 	    {
 	      as_bad (_(".tag target '%s' undefined"), label);
 	      ignore_rest_of_line ();
+	      free (label);
 	      return;
 	    }
 	  stag_add_field_symbols (stag, S_GET_NAME (sym),
 				  S_GET_VALUE (stag->sym), sym, stag->name);
 	}
+      free (label);
     }
 
   /* Bump by the struct size, but only if we're within a .struct section.  */
@@ -933,12 +926,13 @@ tic54x_struct_field (int type)
     }
   else
     {
-      char label[strlen (S_GET_NAME (line_label) + 1)];
+      char * label;
 
-      strcpy (label, S_GET_NAME (line_label));
+      label = xstrdup (S_GET_NAME (line_label));
       stag_add_field (current_stag, label,
 		      abs_section_offset - S_GET_VALUE (current_stag->sym),
 		      NULL);
+      free (label);
     }
 
   if (current_stag->is_union)
@@ -4528,7 +4522,7 @@ subsym_substitute (char *line, int forced)
 	      if (value == NULL)
 		{
 		  char digit[11];
-		  char *namecopy = strcpy (xmalloc (strlen (name) + 1), name);
+		  char *namecopy = xstrdup (name);
 
 		  value = strcpy (xmalloc (strlen (name) + sizeof (digit) + 1),
 				  name);
@@ -4653,7 +4647,7 @@ subsym_substitute (char *line, int forced)
 		 substitutions are performed, or a substitution that has been
 		 previously made is encountered again.
 
-		 put the symbol into the recursion hash table so we only
+		 Put the symbol into the recursion hash table so we only
 		 try to replace a symbol once.  */
 	      if (recurse)
 		{
diff --git a/gas/config/tc-xstormy16.c b/gas/config/tc-xstormy16.c
index 2ea8490..6ee5be3 100644
--- a/gas/config/tc-xstormy16.c
+++ b/gas/config/tc-xstormy16.c
@@ -486,13 +486,14 @@ xstormy16_md_apply_fix (fixS *   fixP,
       const CGEN_OPERAND *operand = cgen_operand_lookup_by_num (cd, opindex);
       const char *errmsg;
       bfd_reloc_code_real_type reloc_type;
-      CGEN_FIELDS *fields = alloca (CGEN_CPU_SIZEOF_FIELDS (cd));
       const CGEN_INSN *insn = fixP->fx_cgen.insn;
 
       /* If the reloc has been fully resolved finish the operand here.  */
       /* FIXME: This duplicates the capabilities of code in BFD.  */
       if (fixP->fx_done)
 	{
+	  CGEN_FIELDS *fields = xmalloc (CGEN_CPU_SIZEOF_FIELDS (cd));
+
 	  CGEN_CPU_SET_FIELDS_BITSIZE (cd) (fields, CGEN_INSN_BITSIZE (insn));
 	  CGEN_CPU_SET_VMA_OPERAND (cd) (cd, opindex, fields, (bfd_vma) value);
 
@@ -516,6 +517,8 @@ xstormy16_md_apply_fix (fixS *   fixP,
 #endif
 	  if (errmsg)
 	    as_bad_where (fixP->fx_file, fixP->fx_line, "%s", errmsg);
+
+	  free (fields);
 	}
 
       if (fixP->fx_done)
diff --git a/gas/config/te-vms.c b/gas/config/te-vms.c
index 884e0a3..36752c3 100644
--- a/gas/config/te-vms.c
+++ b/gas/config/te-vms.c
@@ -115,7 +115,8 @@ vms_file_stats_name (const char *dirname,
 		     char *rfo,
 		     int *ver)
 {
-  char fullname[strlen (dirname) + strlen (filename) + 1];
+  char * fullname;
+
 #ifdef VMS
   struct FAB fab;
   struct NAM nam;
@@ -168,9 +169,7 @@ vms_file_stats_name (const char *dirname,
       return 0;
     }
 
-  strcpy (fullname, dirname);
-  strcat (fullname, filename);
-
+  fullname = concat (dirname, filename, NULL);
   tryfile = to_vms_file_spec (fullname);
 
   /* Allocate and initialize a FAB and NAM structures.  */
@@ -188,14 +187,20 @@ vms_file_stats_name (const char *dirname,
   /* Validate filespec syntax and device existence.  */
   status = SYS$PARSE (&fab, 0, 0);
   if ((status & 1) != 1)
-    return 1;
+    {
+      free (fullname);
+      return 1;
+    }
 
   file.string[nam.nam$b_esl] = 0;
 
   /* Find matching filespec.  */
   status = SYS$SEARCH (&fab, 0, 0);
   if ((status & 1) != 1)
-    return 1;
+    {
+      free (fullname);
+      return 1;
+    }
 
   file.string[nam.nam$b_esl] = 0;
   result.string[result.length=nam.nam$b_rsl] = 0;
@@ -206,7 +211,10 @@ vms_file_stats_name (const char *dirname,
   chan = 0;
   status = SYS$ASSIGN (&devicedsc, &chan, 0, 0, 0);
   if ((status & 1) != 1)
-    return 1;
+    {
+      free (fullname);
+      return 1;
+    }
 
   /* Initialize the FIB and fill in the directory id field.  */
   memset (&fib, 0, sizeof (fib));
@@ -224,22 +232,39 @@ vms_file_stats_name (const char *dirname,
     = SYS$QIOW (0, chan, IO$_ACCESS|IO$M_ACCESS, &iosb, 0, 0,
 		&fibdsc, &filedsc, &result.length, &resultdsc, &atrlst, 0);
   if ((status & 1) != 1)
-    return 1;
+    {
+      free (fullname);
+      return 1;
+    }
+
   if ((iosb.status & 1) != 1)
-    return 1;
+    {
+      free (fullname);
+      return 1;
+    }
 
   result.string[result.length] = 0;
   status = SYS$QIOW (0, chan, IO$_DEACCESS, &iosb, 0, 0, &fibdsc, 0, 0, 0,
 		     &atrlst, 0);
   if ((status & 1) != 1)
-    return 1;
+    {
+      free (fullname);
+      return 1;
+    }
+
   if ((iosb.status & 1) != 1)
-    return 1;
+    {
+      free (fullname);
+      return 1;
+    }
 
   /* Deassign the channel and exit.  */
   status = SYS$DASSGN (chan);
   if ((status & 1) != 1)
-    return 1;
+    {
+      free (fullname);
+      return 1;
+    }
 
   if (cdt) *cdt = create;
   if (siz) *siz = (512 * 65536 * recattr.fat$w_efblkh) +
@@ -253,11 +278,13 @@ vms_file_stats_name (const char *dirname,
   struct tm *ts;
   long long gmtoff, secs, nsecs;
 
-  strcpy (fullname, dirname);
-  strcat (fullname, filename);
+  fullname = concat (dirname, filename, NULL);
 
   if ((stat (fullname, &buff)) != 0)
-     return 1;
+    {
+      free (fullname);
+      return 1;
+    }
 
   if (cdt)
     {
@@ -308,6 +335,7 @@ vms_file_stats_name (const char *dirname,
     *ver = 1;
 #endif /* VMS */
 
+  free (fullname);
   return 0;
 }
 
diff --git a/gas/configure b/gas/configure
index bc5a1ba..6c43279 100755
--- a/gas/configure
+++ b/gas/configure
@@ -11755,7 +11755,7 @@ fi
 
 NO_WERROR=
 if test "${ERROR_ON_WARNING}" = yes ; then
-    GCC_WARN_CFLAGS="$GCC_WARN_CFLAGS -Werror"
+    GCC_WARN_CFLAGS="$GCC_WARN_CFLAGS -Werror -Wstack-usage=262144"
     NO_WERROR="-Wno-error"
 fi
 
diff --git a/gas/dwarf2dbg.c b/gas/dwarf2dbg.c
index c559cad..c719a5a 100644
--- a/gas/dwarf2dbg.c
+++ b/gas/dwarf2dbg.c
@@ -643,13 +643,14 @@ dwarf2_directive_loc (int dummy ATTRIBUTE_UNUSED)
 	{
 	  size_t dir_len = strlen (dirs[files[filenum].dir]);
 	  size_t file_len = strlen (files[filenum].filename);
-	  char *cp = (char *) alloca (dir_len + 1 + file_len + 1);
+	  char *cp = (char *) xmalloc (dir_len + 1 + file_len + 1);
 
 	  memcpy (cp, dirs[files[filenum].dir], dir_len);
 	  INSERT_DIR_SEPARATOR (cp, dir_len);
 	  memcpy (cp + dir_len + 1, files[filenum].filename, file_len);
 	  cp[dir_len + file_len + 1] = '\0';
 	  listing_source_file (cp);
+	  free (cp);
 	}
       else
 	listing_source_file (files[filenum].filename);
diff --git a/gas/macro.c b/gas/macro.c
index b083382..cddf26a 100644
--- a/gas/macro.c
+++ b/gas/macro.c
@@ -1250,13 +1250,14 @@ check_macro (const char *line, sb *expand,
   if (is_name_ender (*s))
     ++s;
 
-  copy = (char *) alloca (s - line + 1);
+  copy = (char *) xmalloc (s - line + 1);
   memcpy (copy, line, s - line);
   copy[s - line] = '\0';
   for (cls = copy; *cls != '\0'; cls ++)
     *cls = TOLOWER (*cls);
 
   macro = (macro_entry *) hash_find (macro_hash, copy);
+  free (copy);
 
   if (macro == NULL)
     return 0;
@@ -1288,7 +1289,7 @@ delete_macro (const char *name)
   macro_entry *macro;
 
   len = strlen (name);
-  copy = (char *) alloca (len + 1);
+  copy = (char *) xmalloc (len + 1);
   for (i = 0; i < len; ++i)
     copy[i] = TOLOWER (name[i]);
   copy[i] = '\0';
@@ -1303,6 +1304,7 @@ delete_macro (const char *name)
     }
   else
     as_warn (_("Attempt to purge non-existant macro `%s'"), copy);
+  free (copy);
 }
 
 /* Handle the MRI IRP and IRPC pseudo-ops.  These are handled as a
diff --git a/gas/remap.c b/gas/remap.c
index 5f7b49e..87eda01 100644
--- a/gas/remap.c
+++ b/gas/remap.c
@@ -73,19 +73,13 @@ const char *
 remap_debug_filename (const char *filename)
 {
   debug_prefix_map *map;
-  char *s;
-  const char *name;
-  size_t name_len;
 
   for (map = debug_prefix_maps; map; map = map->next)
     if (filename_ncmp (filename, map->old_prefix, map->old_len) == 0)
-      break;
-  if (!map)
-    return xstrdup (filename);
-  name = filename + map->old_len;
-  name_len = strlen (name) + 1;
-  s = (char *) alloca (name_len + map->new_len);
-  memcpy (s, map->new_prefix, map->new_len);
-  memcpy (s + map->new_len, name, name_len);
-  return xstrdup (s);
+      {
+	const char *name = filename + map->old_len;
+	return concat (map->new_prefix, name, NULL);
+      }
+	
+  return xstrdup (filename);
 }
diff --git a/gas/stabs.c b/gas/stabs.c
index b734f35..c489af0 100644
--- a/gas/stabs.c
+++ b/gas/stabs.c
@@ -500,9 +500,9 @@ stabs_generate_asm_file (void)
       char *dir2;
 
       dir = remap_debug_filename (getpwd ());
-      dir2 = (char *) alloca (strlen (dir) + 2);
-      sprintf (dir2, "%s%s", dir, "/");
+      dir2 = concat (dir, "/", NULL);
       generate_asm_file (N_SO, dir2);
+      free (dir2);
       xfree ((char *) dir);
     }
   generate_asm_file (N_SO, file);
@@ -635,13 +635,13 @@ stabs_generate_asm_lineno (void)
 
   if (in_dot_func_p)
     {
-      buf = (char *) alloca (100 + strlen (current_function_label));
+      buf = (char *) xmalloc (100 + strlen (current_function_label));
       sprintf (buf, "%d,0,%d,%s-%s\n", N_SLINE, lineno,
 	       sym, current_function_label);
     }
   else
     {
-      buf = (char *) alloca (100);
+      buf = (char *) xmalloc (100);
       sprintf (buf, "%d,0,%d,%s\n", N_SLINE, lineno, sym);
     }
   input_line_pointer = buf;
@@ -650,6 +650,7 @@ stabs_generate_asm_lineno (void)
 
   input_line_pointer = hold;
   outputting_stabs_line_debug = 0;
+  free (buf);
 }
 
 /* Emit a function stab.
diff --git a/gas/symbols.c b/gas/symbols.c
index e117049..62eaf18 100644
--- a/gas/symbols.c
+++ b/gas/symbols.c
@@ -743,34 +743,40 @@ symbol_find (const char *name)
 symbolS *
 symbol_find_noref (const char *name, int noref)
 {
+  symbolS * result;
+  char * copy = NULL;
+
 #ifdef tc_canonicalize_symbol_name
   {
-    char *copy;
-    size_t len = strlen (name) + 1;
-
-    copy = (char *) alloca (len);
-    memcpy (copy, name, len);
+    copy = xstrdup (name);
     name = tc_canonicalize_symbol_name (copy);
   }
 #endif
 
   if (! symbols_case_sensitive)
     {
-      char *copy;
       const char *orig;
+      char *copy2 = NULL;
       unsigned char c;
 
       orig = name;
-      name = copy = (char *) alloca (strlen (name) + 1);
+      if (copy != NULL)
+	copy2 = copy;
+      name = copy = xmalloc (strlen (name) + 1);
 
       while ((c = *orig++) != '\0')
-	{
-	  *copy++ = TOUPPER (c);
-	}
+	*copy++ = TOUPPER (c);
       *copy = '\0';
+
+      if (copy2 != NULL)
+	free (copy2);
+      copy = (char *) name;
     }
 
-  return symbol_find_exact_noref (name, noref);
+  result = symbol_find_exact_noref (name, noref);
+  if (copy != NULL)
+    free (copy);
+  return result;
 }
 
 /* Once upon a time, symbols were kept in a singly linked list.  At