bpf stack smashing detected

	* cgen-dis.c (hash_insn_array): Increase size of buf.  Assert
	size is large enough.

diff --git a/opcodes/ChangeLog b/opcodes/ChangeLog
index 63824c8e336a773acbe69c6bfe790df74a37f7fe..86e381acc976f7865af7d5a54d22ab427f511f74 100644 (file)
--- a/opcodes/ChangeLog
+++ b/opcodes/ChangeLog
@@ -1,3 +1,8 @@
+2020-06-05  Alan Modra  <amodra@gmail.com>
+
+       * cgen-dis.c (hash_insn_array): Increase size of buf.  Assert
+       size is large enough.
+
 2020-06-04  Jose E. Marchesi  <jose.marchesi@oracle.com>
 
        * disassemble.c (disassemble_init_for_target): Set endian_code for

diff --git a/opcodes/cgen-dis.c b/opcodes/cgen-dis.c
index bcc5b4b890982a0750196570031d2b5e35098912..377c93cfab338f1a383001f1748903c10460395f 100644 (file)
--- a/opcodes/cgen-dis.c
+++ b/opcodes/cgen-dis.c
@@ -24,6 +24,7 @@
 #include "bfd.h"
 #include "symcat.h"
 #include "opcode/cgen.h"
+#include "disassemble.h"
 
 static CGEN_INSN_LIST *  hash_insn_array        (CGEN_CPU_DESC, const CGEN_INSN *, int, int, CGEN_INSN_LIST **, CGEN_INSN_LIST *);
 static CGEN_INSN_LIST *  hash_insn_list         (CGEN_CPU_DESC, const CGEN_INSN_LIST *, CGEN_INSN_LIST **, CGEN_INSN_LIST *);
@@ -110,9 +111,10 @@ hash_insn_array (CGEN_CPU_DESC cd,
   for (i = count - 1; i >= 0; --i, ++hentbuf)
     {
       unsigned int hash;
-      char buf [4];
+      char buf [8];
       unsigned long value;
       const CGEN_INSN *insn = &insns[i];
+      size_t size;
 
       if (! (* cd->dis_hash_p) (insn))
        continue;
@@ -121,10 +123,9 @@ hash_insn_array (CGEN_CPU_DESC cd,
         to hash on, so set both up.  */
 
       value = CGEN_INSN_BASE_VALUE (insn);
-      bfd_put_bits ((bfd_vma) value,
-                   buf,
-                   CGEN_INSN_MASK_BITSIZE (insn),
-                   big_p);
+      size = CGEN_INSN_MASK_BITSIZE (insn);
+      OPCODES_ASSERT (size <= sizeof (buf) * 8);
+      bfd_put_bits ((bfd_vma) value, buf, size, big_p);
       hash = (* cd->dis_hash) (buf, value);
       add_insn_to_hash_chain (hentbuf, insn, htable, hash);
     }