gas/arc: Add guard against operand array overflow.

Currently supplying an input file with too many operands to an
instruction will cause the assembler to overflow and array and trigger
undefined behaviour.

This change checks that we don't access outside the limits of the
operand array.

gas/ChangeLog:

	* config/tc-arc.c (tokenize_arguments): Add checks for array
	overflow.
	* testsuite/gas/arc/asm-errors.s: Addition test line added.
	* testsuite/gas/arc/asm-errors.err: Update expected results.

diff --git a/gas/ChangeLog b/gas/ChangeLog
index aa507703ff0dea3347563d1d742a3405d1c2fb8d..bd529cd895444573d8461925e6c3e276f47f27d9 100644 (file)
--- a/gas/ChangeLog
+++ b/gas/ChangeLog
@@ -1,3 +1,10 @@
+2016-05-18  Andrew Burgess  <andrew.burgess@embecosm.com>
+
+       * config/tc-arc.c (tokenize_arguments): Add checks for array
+       overflow.
+       * testsuite/gas/arc/asm-errors.s: Addition test line added.
+       * testsuite/gas/arc/asm-errors.err: Update expected results.
+
 2016-05-18  Trevor Saunders  <tbsaunde+binutils@tbsaunde.org>
 
        * config/tc-rx.c (struct cpu_type): Change the type of a field from

diff --git a/gas/config/tc-arc.c b/gas/config/tc-arc.c
index 28f135b2c783ed1eb737488f37b6ffbebb3759bd..ca94b1f6d9b9e8d4cc2e897c78efedded94394f6 100644 (file)
--- a/gas/config/tc-arc.c
+++ b/gas/config/tc-arc.c
@@ -1039,7 +1039,7 @@ tokenize_arguments (char *str,
        case ']':
          ++input_line_pointer;
          --brk_lvl;
-         if (!saw_arg)
+         if (!saw_arg || num_args == ntok)
            goto err;
          tok->X_op = O_bracket;
          ++tok;
@@ -1049,7 +1049,7 @@ tokenize_arguments (char *str,
        case '{':
        case '[':
          input_line_pointer++;
-         if (brk_lvl)
+         if (brk_lvl || num_args == ntok)
            goto err;
          ++brk_lvl;
          tok->X_op = O_bracket;
@@ -1060,7 +1060,7 @@ tokenize_arguments (char *str,
        case '@':
          /* We have labels, function names and relocations, all
             starting with @ symbol.  Sort them out.  */
-         if (saw_arg && !saw_comma)
+         if ((saw_arg && !saw_comma) || num_args == ntok)
            goto err;
 
          /* Parse @label.  */
@@ -1165,7 +1165,7 @@ tokenize_arguments (char *str,
          /* Fall through.  */
        default:
 
-         if (saw_arg && !saw_comma)
+         if ((saw_arg && !saw_comma) || num_args == ntok)
            goto err;
 
          tok->X_op = O_absent;
@@ -1181,7 +1181,9 @@ tokenize_arguments (char *str,
        normalsymbol:
          debug_exp (tok);
 
-         if (tok->X_op == O_illegal || tok->X_op == O_absent)
+         if (tok->X_op == O_illegal
+              || tok->X_op == O_absent
+              || num_args == ntok)
            goto err;
 
          saw_comma = FALSE;

diff --git a/gas/testsuite/gas/arc/asm-errors.err b/gas/testsuite/gas/arc/asm-errors.err
index 35390fc3e894632bd4882e165a5ba8b0f3bb24a6..e889eb8e0e7a61191156fe9e7e496a306aeff427 100644 (file)
--- a/gas/testsuite/gas/arc/asm-errors.err
+++ b/gas/testsuite/gas/arc/asm-errors.err
@@ -2,3 +2,5 @@
 [^:]*:2: Error: inappropriate arguments for opcode 'adc'
 [^:]*:3: Error: inappropriate arguments for opcode 'adc'
 [^:]*:4: Error: inappropriate arguments for opcode 'adc'
+[^:]*:5: Error: extra comma
+[^:]*:5: Error: syntax error

diff --git a/gas/testsuite/gas/arc/asm-errors.s b/gas/testsuite/gas/arc/asm-errors.s
index 6e0fd6ae1abd6e015a3569f2f7bf345065fb45bc..d3f16c07f41b1637e82ae68b8e75c5a15fd0a569 100644 (file)
--- a/gas/testsuite/gas/arc/asm-errors.s
+++ b/gas/testsuite/gas/arc/asm-errors.s
@@ -2,3 +2,4 @@
         adc.al.ra       r0,r0,r2
         adc.eq.eq       r0,r0,r2
         adc.n.eq        r0,r0,r2
+        add             r0,r0,r0,r0,r0,r0,r0,r0,r0,r0,r0,r0,r0,r0,r0,r0,r0,r0,r0,r0,r0,r0,r0,r0,r0,r0,r0,r0,r0,r0