re PR java/29805 (Write past end of array in java/typeck.c)

	PR java/29805
	* typeck.c (build_java_array_type): Increase buffer sizes.

From-SVN: r118724

diff --git a/gcc/java/ChangeLog b/gcc/java/ChangeLog
index 8bc6c35ec4d5dd766c8239ab7c2eb5cf40a53d77..46d7d1de1de84c269100b515212b5502c809d1f4 100644 (file)
--- a/gcc/java/ChangeLog
+++ b/gcc/java/ChangeLog
@@ -1,3 +1,8 @@
+2006-11-12  David Daney  <ddaney@avtrex.com>
+
+       PR java/29805
+       * typeck.c (build_java_array_type): Increase buffer sizes.
+
 2006-11-11  Richard Guenther  <rguenther@suse.de>
 
        * check-init.c (check_init): Remove handling of FIX_CEIL_EXPR,

diff --git a/gcc/java/typeck.c b/gcc/java/typeck.c
index 3441a1d8663f338ee9e639d47c9060452f2ed436..c0d6e4ab20aa01ba9e52ac0160e2c1f9214d7c4a 100644 (file)
--- a/gcc/java/typeck.c
+++ b/gcc/java/typeck.c
@@ -356,7 +356,7 @@ tree
 build_java_array_type (tree element_type, HOST_WIDE_INT length)
 {
   tree sig, t, fld, atype, arfld;
-  char buf[12];
+  char buf[23]; /* 20 for the digits of a 64 bit number + "[]" + \0 */
   tree elsig = build_java_signature (element_type);
   tree el_name = element_type;
   buf[0] = '[';
@@ -379,7 +379,7 @@ build_java_array_type (tree element_type, HOST_WIDE_INT length)
   if (TREE_CODE (el_name) == TYPE_DECL)
     el_name = DECL_NAME (el_name);
   {
-    char suffix[12];
+    char suffix[23];
     if (length >= 0)
       sprintf (suffix, "[%d]", (int)length); 
     else