PR26481 UBSAN: tc-pj.c:281 index out of bounds

	PR 26481
	* config/tc-pj.c (md_assemble): Don't loop past end of
	opcode->arg array.

diff --git a/gas/ChangeLog b/gas/ChangeLog
index 9bdbb4b172f3fda855cf48e70e593f3102409884..210a22c70bbd0d57b286c0b4654c0db8570df894 100644 (file)
--- a/gas/ChangeLog
+++ b/gas/ChangeLog
@@ -1,3 +1,9 @@
+2020-08-29  Alan Modra  <amodra@gmail.com>
+
+       PR 26481
+       * config/tc-pj.c (md_assemble): Don't loop past end of
+       opcode->arg array.
+
 2020-08-28  Alan Modra  <amodra@gmail.com>
 
        PR 26460

diff --git a/gas/config/tc-pj.c b/gas/config/tc-pj.c
index bc4b8cb117c698c3c60a5eb4c8cc1ff7f1d71fc9..1ec84542d079bfde75bc78fded44e5324d211719 100644 (file)
--- a/gas/config/tc-pj.c
+++ b/gas/config/tc-pj.c
@@ -270,7 +270,7 @@ md_assemble (char *str)
     }
   else
     {
-      int an;
+      unsigned int an;
 
       output = frag_more (opcode->len);
       output[idx++] = opcode->opcode;
@@ -278,7 +278,7 @@ md_assemble (char *str)
       if (opcode->opcode_next != -1)
        output[idx++] = opcode->opcode_next;
 
-      for (an = 0; opcode->arg[an]; an++)
+      for (an = 0; an < ARRAY_SIZE (opcode->arg) && opcode->arg[an]; an++)
        {
          expressionS arg;