asan: use of uninitialized value in buffer_and_nest

More occurences of the same as commit d12b8d620c6a.

	* macro.c (buffer_and_nest): Sanity check length in buffer
	before calling strncasecmp.

diff --git a/gas/macro.c b/gas/macro.c
index cbb9574fd667ab45fe8036d7ba4d7012fb788c58..2228f5b5404fbb586380613c512c6073ca7e38b0 100644 (file)
--- a/gas/macro.c
+++ b/gas/macro.c
@@ -184,9 +184,9 @@ buffer_and_nest (const char *from, const char *to, sb *ptr,
        {
          if (! flag_m68k_mri && ptr->ptr[i] == '.')
            i++;
+         size_t len = ptr->len - i;
          if (from == NULL)
            {
-             size_t len = ptr->len - i;
              if (len >= 5 && strncasecmp (ptr->ptr + i, "IREPC", 5) == 0)
                from_len = 5;
              else if (len >= 4 && strncasecmp (ptr->ptr + i, "IREP", 4) == 0)
@@ -203,15 +203,16 @@ buffer_and_nest (const char *from, const char *to, sb *ptr,
                from_len = 0;
            }
          if ((from != NULL
-              ? strncasecmp (ptr->ptr + i, from, from_len) == 0
+              ? (len >= from_len
+                 && strncasecmp (ptr->ptr + i, from, from_len) == 0)
               : from_len > 0)
-             && (ptr->len == (i + from_len)
+             && (len == from_len
                  || ! (is_part_of_name (ptr->ptr[i + from_len])
                        || is_name_ender (ptr->ptr[i + from_len]))))
            depth++;
-         if (ptr->len - i >= to_len
+         if (len >= to_len
              && strncasecmp (ptr->ptr + i, to, to_len) == 0
-             && (ptr->len == (i + to_len)
+             && (len == to_len
                  || ! (is_part_of_name (ptr->ptr[i + to_len])
                        || is_name_ender (ptr->ptr[i + to_len]))))
            {
@@ -233,7 +234,7 @@ buffer_and_nest (const char *from, const char *to, sb *ptr,
             number when expanding the macro), and since for short
             macros we clearly prefer reporting the point of expansion
             anyway, there's not an obviously better fix here.  */
-         if (strncasecmp (ptr->ptr + i, "linefile", 8) == 0)
+         if (len >= 8 && strncasecmp (ptr->ptr + i, "linefile", 8) == 0)
            {
              char saved_eol_char = ptr->ptr[ptr->len];