From 6e1ee99772d2f0c07b4a2c65f3c1593fbf55d9c1 Mon Sep 17 00:00:00 2001 From: Alan Modra Date: Thu, 2 Mar 2023 08:12:00 +1030 Subject: [PATCH] More bounds checking in macro_expand * macro.c (macro_expand): Ensure input string buffer is not read past end. --- gas/macro.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/gas/macro.c b/gas/macro.c index 74a1317cb11..fae94ae42c1 100644 --- a/gas/macro.c +++ b/gas/macro.c @@ -1120,7 +1120,7 @@ macro_expand (size_t idx, sb *in, macro_entry *m, sb *out) then the actual stuff. */ sb_reset (&t); idx = get_token (idx, in, &t); - if (in->ptr[idx] != '=') + if (idx >= in->len || in->ptr[idx] != '=') { err = _("confusion in formal parameters"); break; @@ -1184,7 +1184,7 @@ macro_expand (size_t idx, sb *in, macro_entry *m, sb *out) if (f->type != FORMAL_VARARG) idx = get_any_string (idx, in, &f->actual); - else + else if (idx < in->len) { sb_add_buffer (&f->actual, in->ptr + idx, in->len - idx); idx = in->len; @@ -1202,9 +1202,9 @@ macro_expand (size_t idx, sb *in, macro_entry *m, sb *out) idx = sb_skip_comma (idx, in); else { - if (in->ptr[idx] == ',') + if (idx < in->len && in->ptr[idx] == ',') ++idx; - if (ISWHITE (in->ptr[idx])) + if (idx < in->len && ISWHITE (in->ptr[idx])) break; } } -- 2.30.2