From: Laurent GUERBY <laurent@guerby.net>
Date: Wed, 25 Feb 2009 17:22:58 +0000 (+0000)
Subject: a-teioed.adb (Expand): Fix Result overflow.
X-Git-Tag: releases/gcc-4.4.0~437
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=054efbba9dbf01e8f1b52f01aafa324f57f701ba;p=thirdparty%2Fgcc.git

a-teioed.adb (Expand): Fix Result overflow.

2009-02-25  Laurent GUERBY  <laurent@guerby.net>

        * a-teioed.adb (Expand): Fix Result overflow.

From-SVN: r144427
---

diff --git a/gcc/ada/ChangeLog b/gcc/ada/ChangeLog
index 826b2047eea6..d7d0434ef7b3 100644
--- a/gcc/ada/ChangeLog
+++ b/gcc/ada/ChangeLog
@@ -1,3 +1,7 @@
+2009-02-25  Laurent GUERBY  <laurent@guerby.net>
+
+        * a-teioed.adb (Expand): Fix Result overflow.
+        
 2009-02-25  Laurent GUERBY <laurent@guerby.net>
 
         * gcc-interface/Makefile.in: Fix multilib handling for
diff --git a/gcc/ada/a-teioed.adb b/gcc/ada/a-teioed.adb
index a5c2b662e369..081cef6fa060 100644
--- a/gcc/ada/a-teioed.adb
+++ b/gcc/ada/a-teioed.adb
@@ -84,6 +84,10 @@ package body Ada.Text_IO.Editing is
                --  character has already been made, so a count of one is a
                --  no-op, and a count of zero erases a character.
 
+               if Result_Index + Count - 2 > Result'Last then
+                  raise Picture_Error;
+               end if;
+
                for J in 2 .. Count loop
                   Result (Result_Index + J - 2) := Picture (Picture_Index - 1);
                end loop;
@@ -98,6 +102,10 @@ package body Ada.Text_IO.Editing is
                raise Picture_Error;
 
             when others =>
+               if Result_Index > Result'Last then
+                  raise Picture_Error;
+               end if;
+
                Result (Result_Index) := Picture (Picture_Index);
                Picture_Index := Picture_Index + 1;
                Result_Index := Result_Index + 1;