Fix invalid strcpy on unterminated buffer

* read.c (do_repeat_with_expander): Use memmove instead of strcpy
on unterminated string buffer.

diff --git a/gas/ChangeLog b/gas/ChangeLog
index 366f4c111cf18755a9265b81e8dfc3f68ba2ba76..5343503667ce11f75aa6c209e04eb93b269097cb 100644 (file)
--- a/gas/ChangeLog
+++ b/gas/ChangeLog
@@ -1,3 +1,8 @@
+2018-08-21  Andreas Schwab  <schwab@suse.de>
+
+       * read.c (do_repeat_with_expander): Use memmove instead of strcpy
+       on unterminated string buffer.
+
 2018-08-21  Alan Modra  <amodra@gmail.com>
 
        * config/tc-ppc.c (md_assemble): Delay counting of optional

diff --git a/gas/read.c b/gas/read.c
index 1f211b6819b467eeab08a6667cd8a9199f0078c2..f011149bb36392fbb7c1fae5054ddce457e3f382 100644 (file)
--- a/gas/read.c
+++ b/gas/read.c
@@ -3117,7 +3117,8 @@ do_repeat_with_expander (size_t count,
          sub = strstr (processed.ptr, expander);
          len = sprintf (sub, "%lu", (unsigned long) count);
          gas_assert (len < 8);
-         strcpy (sub + len, sub + 8);
+         memmove (sub + len, sub + 8,
+                  processed.ptr + processed.len - (sub + 8));
          processed.len -= (8 - len);
          sb_add_sb (& many, & processed);
          sb_kill (& processed);