espressif/binutils-gdb
1
0
Fork 0
mirror of https://github.com/espressif/binutils-gdb.git synced 2025-06-23 19:50:13 +08:00
Code Issues Packages Projects Releases Wiki Activity

asan: buffer overflows after calling ignore_rest_of_line

Browse Source 
operand() is not a place that should be calling ignore_rest_of_line.
ignore_rest_of_line shouldn't increment input_line_pointer if already
at buffer limit.

	* expr.c (operand): Don't call ignore_rest_of_line.
	* read.c (s_mri_common): Likewise.
	(ignore_rest_of_line): Don't increment input_line_pointer if
	already at buffer_limit.
This commit is contained in:
Alan Modra
2022-03-17 11:54:40 +10:30
parent df573325cb
commit 0d1064face
2 changed files with 4 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
gas/expr.c
View File

@ -1212,9 +1212,7 @@ operand (expressionS *expressionP, enum expr_mode mode)
{ {
as_bad (_("expected symbol name")); as_bad (_("expected symbol name"));
(void) restore_line_pointer (c); (void) restore_line_pointer (c);
if (c != ')') if (c == ')')
ignore_rest_of_line ();
else
++input_line_pointer; ++input_line_pointer;
break; break;
} }

12
gas/read.c
View File

@ -1940,7 +1940,6 @@ s_mri_common (int small ATTRIBUTE_UNUSED)
if (S_IS_DEFINED (sym) && !S_IS_COMMON (sym)) if (S_IS_DEFINED (sym) && !S_IS_COMMON (sym))
{ {
as_bad (_("symbol `%s' is already defined"), S_GET_NAME (sym)); as_bad (_("symbol `%s' is already defined"), S_GET_NAME (sym));
ignore_rest_of_line ();
mri_comment_end (stop, stopc); mri_comment_end (stop, stopc);
return; return;
} }
@ -3980,15 +3979,10 @@ demand_empty_rest_of_line (void)
void void
ignore_rest_of_line (void) ignore_rest_of_line (void)
{ {
while (input_line_pointer < buffer_limit while (input_line_pointer < buffer_limit)
&& !is_end_of_line[(unsigned char) *input_line_pointer]) if (is_end_of_line[(unsigned char) *input_line_pointer++])
input_line_pointer++; break;
input_line_pointer++;
/* Return pointing just after end-of-line. */ /* Return pointing just after end-of-line. */
if (input_line_pointer <= buffer_limit)
know (is_end_of_line[(unsigned char) input_line_pointer[-1]]);
} }
/* Sets frag for given symbol to zero_address_frag, except when the /* Sets frag for given symbol to zero_address_frag, except when the