re PR preprocessor/8055 (PATCH: cpp0 dies with SIG11 when building FreeBSD kernel)

2002-09-27  Alexander N. Kabaev <ak03@gte.com>

	PR preprocessor/8055
	* cppmacro.c (stringify_arg): Do not overflow the buffer
	with the terminating NUL when the argument to be stringified
	has no tokens.
	* testsuite/gcc.dg/cpp/20020927-1.c: New.

From-SVN: r57599

diff --git a/gcc/ChangeLog b/gcc/ChangeLog
index c354cf995f4ef9172258ab83646067d66dd7c92e..2af02d4bb6cfc35d9b18e0ce7b89f85953629591 100644 (file)
--- a/gcc/ChangeLog
+++ b/gcc/ChangeLog
@@ -1,3 +1,10 @@
+2002-09-27  Alexander N. Kabaev <ak03@gte.com>
+
+       PR preprocessor/8055
+       * cppmacro.c (stringify_arg): Do not overflow the buffer
+       with the terminating NUL when the argument to be stringified
+       has no tokens.
+
 2002-09-27  Richard Henderson  <rth@redhat.com>
 
        * unroll.c (simplify_cmp_and_jump_insns): New.
@@ -74,7 +81,7 @@
 
        * dbxout.c (FORCE_TEXT): Switch to current_function_decl, not
        text_section.
-       * xcoffout.h (DBX_STATIC_BLOCK_START): Remove explicit change to 
+       * xcoffout.h (DBX_STATIC_BLOCK_START): Remove explicit change to
        text section.
        * config/rs6000/rs6000.c (rs6000_override_options): Allow
        function-sections and data-sections functionality on AIX.
@@ -143,12 +150,12 @@
 
 2002-09-24  Eric Christopher  <echristo@redhat.com>
 
-        * config/mips/elf.h: Add HANDLE_SYSV_PRAGMA.
-        * config/mips/elf64.h: Ditto.
+       * config/mips/elf.h: Add HANDLE_SYSV_PRAGMA.
+       * config/mips/elf64.h: Ditto.
 
 2002-09-24  Eric Christopher  <echristo@redhat.com>
 
-        * except.c (expand_builtin_extract_return_address): Handle case
+       * except.c (expand_builtin_extract_return_address): Handle case
        where Pmode != ptr_mode.
 
 2002-09-26  Steve Ellcey  <sje@cup.hp.com>
@@ -224,11 +231,11 @@
 
 2002-09-24  Adam Nemet  <anemet@lnxw.com>
 
-        * config/arm/arm.c (thumb_unexpanded_epilogue): Don't generate
-        epilogue for naked functions.
+       * config/arm/arm.c (thumb_unexpanded_epilogue): Don't generate
+       epilogue for naked functions.
 
 2002-09-24  Adam Nemet  <anemet@lnxw.com>
-            Nick Clifton  <nickc@redhat.com>
+           Nick Clifton  <nickc@redhat.com>
 
        * config/arm/arm.h (THUMB_FUNCTION_PROFILER): Remove.
        (FUNCTION_PROFILER): Only invoke THUMB_FUNCTION_PROFILER if it

diff --git a/gcc/cppmacro.c b/gcc/cppmacro.c
index b8fb792de885aed425d90d987b3a426f7202def9..113b20dac24da3c6eb262ce4348ac4f8cf2bcb8f 100644 (file)
--- a/gcc/cppmacro.c
+++ b/gcc/cppmacro.c
@@ -409,6 +409,12 @@ stringify_arg (pfile, arg)
     }
 
   /* Commit the memory, including NUL, and return the token.  */
+  if ((size_t) (BUFF_LIMIT (pfile->u_buff) - dest) < 1)
+    {
+      size_t len_so_far = dest - BUFF_FRONT (pfile->u_buff);
+      _cpp_extend_buff (pfile, &pfile->u_buff, 1);
+      dest = BUFF_FRONT (pfile->u_buff) + len_so_far;
+    }
   len = dest - BUFF_FRONT (pfile->u_buff);
   BUFF_FRONT (pfile->u_buff) = dest + 1;
   return new_string_token (pfile, dest - len, len);

diff --git a/gcc/testsuite/ChangeLog b/gcc/testsuite/ChangeLog
index d211f1b0f3741371d17bfa2aa5e0c6c90ffedb72..b5bea3dc5892074bf1f079140e40d3ccf2f85b9e 100644 (file)
--- a/gcc/testsuite/ChangeLog
+++ b/gcc/testsuite/ChangeLog
@@ -1,3 +1,7 @@
+2002-09-27  Zack Weinberg  <zack@codesourcery.com>
+
+       * gcc.dg/cpp/20020927-1.c: New.
+
 2002-09-26  David S. Miller  <davem@redhat.com>
 
        * gcc.c-torture/compile/trunctfdf.c: New.
@@ -98,7 +102,7 @@ Tue Sep 17 13:59:45 2002  Nicola Pero  <n.pero@mi.flashnet.it>
        * objc.dg/comp-types-3.m: New test.
        * objc.dg/comp-types-4.m: New test.
        * objc.dg/comp-types-5.m: New test.
-       * objc.dg/comp-types-6.m: New test.     
+       * objc.dg/comp-types-6.m: New test.
 
 2002-09-17  John David Anglin  <dave@hiauly1.hia.nrc.ca>
 
@@ -107,9 +111,9 @@ Tue Sep 17 13:59:45 2002  Nicola Pero  <n.pero@mi.flashnet.it>
 2002-09-16  Nathan Sidwell  <nathan@codesourcery.com>
 
        * g++.dg/other/do1.C: New test.
-       
+
        * g++.dg/template/subst1.C: New test.
-       
+
 2002-09-16  Steve Ellcey  <sje@cup.hp.com>
 
        * gcc.dg/20020312-2.c: Change __parisc__ to __hppa__.

diff --git a/gcc/testsuite/gcc.dg/cpp/20020927-1.c b/gcc/testsuite/gcc.dg/cpp/20020927-1.c
new file mode 100644 (file)
index 0000000..91f8951
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/cpp/20020927-1.c
@@ -0,0 +1,91 @@
+/* Test case for buffer overflow bug in token stringification.
+   See PR preprocessor/8055 for details.
+   Reported by Alexander N. Kabaev <ak03@gte.com>.
+   Test case written by Zack Weinberg <zack@codesourcery.com>.  */
+
+/* { dg-do preprocess } */
+
+#define S(x) #x
+
+/* Fill up one internal buffer with data.  */
+S(1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  1234567890123456789012345678901234567890123456789012345678901234567890
+  12345678901234567890123456789012345678901234567890123456789012345)
+
+/* When stringify_arg() was called with an empty macro argument, it would
+   advance the buffer pointer by one but fail to check for running past the
+   end of the buffer.  We can only know where the end of the buffer is to
+   within about eight bytes, so do this sixteen times to be sure of hitting
+   it.  */
+
+S()
+S()
+S()
+S()
+S()
+S()
+S()
+S()
+S()
+S()
+S()
+S()
+S()
+S()
+S()
+S()
+
+/* Now allocate more memory in the buffer, which should provoke a crash.  */
+
+S(abcdefghijklmnopqrstuvwxyz)
+S(abcdefghijklmnopqrstuvwxyz)