Toolchain/binutils-gdb
1
0
Fork 0
forked from Imagelibrary/binutils-gdb
Code Pull Requests Activity

asan: use of uninitialized value in buffer_and_nest

Browse Source 
More occurences of the same as commit d12b8d620c.

	* macro.c (buffer_and_nest): Sanity check length in buffer
	before calling strncasecmp.
This commit is contained in:
Alan Modra
2022-03-17 16:04:22 +10:30
parent 6109e902f1
commit 4c5f3d0c9e
1 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
gas/macro.c
View File

@@ -184,9 +184,9 @@ buffer_and_nest (const char *from, const char *to, sb *ptr,
{
if (! flag_m68k_mri && ptr->ptr[i] == '.')
i++;
size_t len = ptr->len - i;
if (from == NULL)
{
size_t len = ptr->len - i;
if (len >= 5 && strncasecmp (ptr->ptr + i, "IREPC", 5) == 0)
from_len = 5;
else if (len >= 4 && strncasecmp (ptr->ptr + i, "IREP", 4) == 0)
@@ -203,15 +203,16 @@ buffer_and_nest (const char *from, const char *to, sb *ptr,
from_len = 0;
}
if ((from != NULL
? strncasecmp (ptr->ptr + i, from, from_len) == 0
? (len >= from_len
&& strncasecmp (ptr->ptr + i, from, from_len) == 0)
: from_len > 0)
&& (ptr->len == (i + from_len)
&& (len == from_len
|| ! (is_part_of_name (ptr->ptr[i + from_len])
|| is_name_ender (ptr->ptr[i + from_len]))))
depth++;
if (ptr->len - i >= to_len
if (len >= to_len
&& strncasecmp (ptr->ptr + i, to, to_len) == 0
&& (ptr->len == (i + to_len)
&& (len == to_len
|| ! (is_part_of_name (ptr->ptr[i + to_len])
|| is_name_ender (ptr->ptr[i + to_len]))))
{
@@ -233,7 +234,7 @@ buffer_and_nest (const char *from, const char *to, sb *ptr,
number when expanding the macro), and since for short
macros we clearly prefer reporting the point of expansion
anyway, there's not an obviously better fix here. */
if (strncasecmp (ptr->ptr + i, "linefile", 8) == 0)
if (len >= 8 && strncasecmp (ptr->ptr + i, "linefile", 8) == 0)
{
char saved_eol_char = ptr->ptr[ptr->len];