a-teioed.adb (Expand): Fix Result overflow.

2009-02-25  Laurent GUERBY  <laurent@guerby.net>

        * a-teioed.adb (Expand): Fix Result overflow.

From-SVN: r144427

diff --git a/gcc/ada/ChangeLog b/gcc/ada/ChangeLog
index 826b2047eea6ead6a4df6c3edf0ea02c1527ebc2..d7d0434ef7b3fab05e5bbc0e73539d1b7cf81e9d 100644 (file)
--- a/gcc/ada/ChangeLog
+++ b/gcc/ada/ChangeLog
@@ -1,3 +1,7 @@
+2009-02-25  Laurent GUERBY  <laurent@guerby.net>
+
+        * a-teioed.adb (Expand): Fix Result overflow.
+        
 2009-02-25  Laurent GUERBY <laurent@guerby.net>
 
         * gcc-interface/Makefile.in: Fix multilib handling for

diff --git a/gcc/ada/a-teioed.adb b/gcc/ada/a-teioed.adb
index a5c2b662e369b4b72d9d9889ae691c749d7f19ae..081cef6fa060289c6a7bebf83b22e35db062944c 100644 (file)
--- a/gcc/ada/a-teioed.adb
+++ b/gcc/ada/a-teioed.adb
@@ -84,6 +84,10 @@ package body Ada.Text_IO.Editing is
                --  character has already been made, so a count of one is a
                --  no-op, and a count of zero erases a character.
 
+               if Result_Index + Count - 2 > Result'Last then
+                  raise Picture_Error;
+               end if;
+
                for J in 2 .. Count loop
                   Result (Result_Index + J - 2) := Picture (Picture_Index - 1);
                end loop;
@@ -98,6 +102,10 @@ package body Ada.Text_IO.Editing is
                raise Picture_Error;
 
             when others =>
+               if Result_Index > Result'Last then
+                  raise Picture_Error;
+               end if;
+
                Result (Result_Index) := Picture (Picture_Index);
                Picture_Index := Picture_Index + 1;
                Result_Index := Result_Index + 1;