From: Nick Clifton <nickc@redhat.com>
Date: Tue, 6 Dec 2016 15:31:14 +0000 (+0000)
Subject: Stop the assembler from running out of memory when asked to generate a huge number... 
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=005304aae36522a90bbe169faea36db559d0f3d6;p=binutils-gdb.git

Stop the assembler from running out of memory when asked to generate a huge number of spaces.

	PR gas/20901
	* read.c (s_space): Place an upper limit on the number of spaces
	generated.
---

diff --git a/gas/ChangeLog b/gas/ChangeLog
index bb6beb8e3c3..781e975920c 100644
--- a/gas/ChangeLog
+++ b/gas/ChangeLog
@@ -1,5 +1,9 @@
 2016-12-06  Nick Clifton  <nickc@redhat.com>
 
+	PR gas/20901
+	* read.c (s_space): Place an upper limit on the number of spaces
+	generated.
+
 	PR gas/20896
 	* testsuite/gas/mmix/err-byte1.s: Adjust expected warning messages
 	to account for patch to next_char_of_string.
diff --git a/gas/read.c b/gas/read.c
index 0cc0d2062ee..08b8846f151 100644
--- a/gas/read.c
+++ b/gas/read.c
@@ -3394,11 +3394,20 @@ s_space (int mult)
 	{
 	  offsetT i;
 
-	  if (mult == 0)
-	    mult = 1;
-	  bytes = mult * exp.X_add_number;
-	  for (i = 0; i < exp.X_add_number; i++)
-	    emit_expr (&val, mult);
+	  /* PR 20901: Check for excessive values.
+	     FIXME: 1<<10 is an arbitrary limit.  Maybe use maxpagesize instead ?  */
+	  if (exp.X_add_number < 0 || exp.X_add_number > (1 << 10))
+	    as_bad (_("size value for s_space directive too large: %lx"),
+		    (long) exp.X_add_number);
+	  else
+	    {
+	      if (mult == 0)
+		mult = 1;
+	      bytes = mult * exp.X_add_number;
+
+	      for (i = 0; i < exp.X_add_number; i++)
+		emit_expr (&val, mult);
+	    }
 	}
     }
   else