Toolchain/binutils-gdb
1
0
Fork 0
forked from Imagelibrary/binutils-gdb
Code Pull Requests Activity

asan: heap buffer overflow in pa_chk_field_selector

Browse Source 
The buffer overflow showed up running the gas "all macro" test.

	PR 29005
	* config/tc-hppa.c (pa_chk_field_selector): Don't read past end
	of line.
This commit is contained in:
Alan Modra
2022-03-28 17:51:30 +10:30
parent 4a02e01a71
commit 1fc6fa2f1b
1 changed files with 28 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
gas/config/tc-hppa.c
View File

@@ -2432,24 +2432,37 @@ pa_chk_field_selector (char **str)
int middle, low, high; int middle, low, high;
int cmp; int cmp;
char name[4]; char name[4];
char *s = *str;
/* Read past any whitespace. */ /* Read past any whitespace. */
/* FIXME: should we read past newlines and formfeeds??? */ while (*s == ' ' || *s == '\t')
while (**str == ' ' || **str == '\t' || **str == '\n' || **str == '\f') s++;
*str = *str + 1; *str = s;
if ((*str)[1] == '\'' || (*str)[1] == '%') if (is_end_of_line [(unsigned char) s[0]])
name[0] = TOLOWER ((*str)[0]), return e_fsel;
name[1] = 0; else if (s[1] == '\'' || s[1] == '%')
else if ((*str)[2] == '\'' || (*str)[2] == '%') {
name[0] = TOLOWER ((*str)[0]), name[0] = TOLOWER (s[0]);
name[1] = TOLOWER ((*str)[1]), name[1] = 0;
name[2] = 0; }
else if ((*str)[3] == '\'' || (*str)[3] == '%') else if (is_end_of_line [(unsigned char) s[1]])
name[0] = TOLOWER ((*str)[0]), return e_fsel;
name[1] = TOLOWER ((*str)[1]), else if (s[2] == '\'' || s[2] == '%')
name[2] = TOLOWER ((*str)[2]), {
name[3] = 0; name[0] = TOLOWER (s[0]);
name[1] = TOLOWER (s[1]);
name[2] = 0;
}
else if (is_end_of_line [(unsigned char) s[2]])
return e_fsel;
else if (s[3] == '\'' || s[3] == '%')
{
name[0] = TOLOWER (s[0]);
name[1] = TOLOWER (s[1]);
name[2] = TOLOWER (s[2]);
name[3] = 0;
}
else else
return e_fsel; return e_fsel;