From 4c5f3d0c9eb3ebe49f822bd1aabd3184f24998d8 Mon Sep 17 00:00:00 2001 From: Alan Modra Date: Thu, 17 Mar 2022 16:04:22 +1030 Subject: [PATCH] asan: use of uninitialized value in buffer_and_nest More occurences of the same as commit d12b8d620c6a. * macro.c (buffer_and_nest): Sanity check length in buffer before calling strncasecmp. --- gas/macro.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/gas/macro.c b/gas/macro.c index cbb9574fd66..2228f5b5404 100644 --- a/gas/macro.c +++ b/gas/macro.c @@ -184,9 +184,9 @@ buffer_and_nest (const char *from, const char *to, sb *ptr, { if (! flag_m68k_mri && ptr->ptr[i] == '.') i++; + size_t len = ptr->len - i; if (from == NULL) { - size_t len = ptr->len - i; if (len >= 5 && strncasecmp (ptr->ptr + i, "IREPC", 5) == 0) from_len = 5; else if (len >= 4 && strncasecmp (ptr->ptr + i, "IREP", 4) == 0) @@ -203,15 +203,16 @@ buffer_and_nest (const char *from, const char *to, sb *ptr, from_len = 0; } if ((from != NULL - ? strncasecmp (ptr->ptr + i, from, from_len) == 0 + ? (len >= from_len + && strncasecmp (ptr->ptr + i, from, from_len) == 0) : from_len > 0) - && (ptr->len == (i + from_len) + && (len == from_len || ! (is_part_of_name (ptr->ptr[i + from_len]) || is_name_ender (ptr->ptr[i + from_len])))) depth++; - if (ptr->len - i >= to_len + if (len >= to_len && strncasecmp (ptr->ptr + i, to, to_len) == 0 - && (ptr->len == (i + to_len) + && (len == to_len || ! (is_part_of_name (ptr->ptr[i + to_len]) || is_name_ender (ptr->ptr[i + to_len])))) { @@ -233,7 +234,7 @@ buffer_and_nest (const char *from, const char *to, sb *ptr, number when expanding the macro), and since for short macros we clearly prefer reporting the point of expansion anyway, there's not an obviously better fix here. */ - if (strncasecmp (ptr->ptr + i, "linefile", 8) == 0) + if (len >= 8 && strncasecmp (ptr->ptr + i, "linefile", 8) == 0) { char saved_eol_char = ptr->ptr[ptr->len]; -- 2.30.2