From: Alan Modra <amodra@gmail.com>
Date: Wed, 1 Mar 2023 21:42:00 +0000 (+1030)
Subject: More bounds checking in macro_expand
X-Git-Tag: binutils-2_41~1540
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6e1ee99772d2f0c07b4a2c65f3c1593fbf55d9c1;p=thirdparty%2Fbinutils-gdb.git

More bounds checking in macro_expand

	* macro.c (macro_expand): Ensure input string buffer is not
	read past end.
---

diff --git a/gas/macro.c b/gas/macro.c
index 74a1317cb11..fae94ae42c1 100644
--- a/gas/macro.c
+++ b/gas/macro.c
@@ -1120,7 +1120,7 @@ macro_expand (size_t idx, sb *in, macro_entry *m, sb *out)
 	     then the actual stuff.  */
 	  sb_reset (&t);
 	  idx = get_token (idx, in, &t);
-	  if (in->ptr[idx] != '=')
+	  if (idx >= in->len || in->ptr[idx] != '=')
 	    {
 	      err = _("confusion in formal parameters");
 	      break;
@@ -1184,7 +1184,7 @@ macro_expand (size_t idx, sb *in, macro_entry *m, sb *out)
 
 	  if (f->type != FORMAL_VARARG)
 	    idx = get_any_string (idx, in, &f->actual);
-	  else
+	  else if (idx < in->len)
 	    {
 	      sb_add_buffer (&f->actual, in->ptr + idx, in->len - idx);
 	      idx = in->len;
@@ -1202,9 +1202,9 @@ macro_expand (size_t idx, sb *in, macro_entry *m, sb *out)
 	idx = sb_skip_comma (idx, in);
       else
 	{
-	  if (in->ptr[idx] == ',')
+	  if (idx < in->len && in->ptr[idx] == ',')
 	    ++idx;
-	  if (ISWHITE (in->ptr[idx]))
+	  if (idx < in->len && ISWHITE (in->ptr[idx]))
 	    break;
 	}
     }