Fix TIC54X buffer overruns

MALLOC_PERTURB_=1 results in "FAIL: c54x macros".

	* config/tc-tic54x.c (tic54x_mlib): Don't write garbage past
	end of archive to temp file.
	(tic54x_start_line_hook): Start scan for parallel on next line,
	not one char into next line (which may overrun the buffer).

diff --git a/gas/ChangeLog b/gas/ChangeLog
index 7f6ec0346877c2e06a33beaeb9d697791c376dc7..7e3971543c34208c7fa4191cf7485420971cb8f7 100644 (file)
--- a/gas/ChangeLog
+++ b/gas/ChangeLog
@@ -1,3 +1,10 @@
+2014-06-16  Alan Modra  <amodra@gmail.com>
+
+       * config/tc-tic54x.c (tic54x_mlib): Don't write garbage past
+       end of archive to temp file.
+       (tic54x_start_line_hook): Start scan for parallel on next line,
+       not one char into next line (which may overrun the buffer).
+
 2014-06-16  Alan Modra  <amodra@gmail.com>
 
        * config/tc-vax.c (md_apply_fix): Rewrite.

diff --git a/gas/config/tc-tic54x.c b/gas/config/tc-tic54x.c
index bba743ccf7148391ecb00d1d477aee3da0fce708..c9972975bdcdfdc738c2709e1af0182ad12c6a51 100644 (file)
--- a/gas/config/tc-tic54x.c
+++ b/gas/config/tc-tic54x.c
@@ -2368,13 +2368,13 @@ tic54x_mlib (int ignore ATTRIBUTE_UNUSED)
       FILE *ftmp;
 
       /* We're not sure how big it is, but it will be smaller than "size".  */
-      bfd_bread (buf, size, mbfd);
+      size = bfd_bread (buf, size, mbfd);
 
       /* Write to a temporary file, then use s_include to include it
         a bit of a hack.  */
       ftmp = fopen (fname, "w+b");
       fwrite ((void *) buf, size, 1, ftmp);
-      if (buf[size - 1] != '\n')
+      if (size == 0 || buf[size - 1] != '\n')
        fwrite ("\n", 1, 1, ftmp);
       fclose (ftmp);
       free (buf);
@@ -4777,7 +4777,7 @@ tic54x_start_line_hook (void)
   line[endp - input_line_pointer] = 0;
 
   /* Scan ahead for parallel insns.  */
-  parallel_on_next_line_hint = next_line_shows_parallel (endp + 1);
+  parallel_on_next_line_hint = next_line_shows_parallel (endp);
 
   /* If within a macro, first process forced replacements.  */
   if (macro_level > 0)