From: Alan Modra <amodra@gmail.com>
Date: Wed, 28 Jan 2026 07:38:09 +0000 (+1030)
Subject: gas: segmentation fault in as_report_context
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ea96771a0188a235645558ae10d6885c91c1ac00;p=thirdparty%2Fbinutils-gdb.git

gas: segmentation fault in as_report_context

After input_scrub_end when next_saved_file is NULL, it is possible
that macro_nest will be non-zero on files with errors.  If
output_file_close then has an error and reports it with as_fatal we
hit the segfault.

	PR 33746
	* input_scrub.c (as_report_context): Don't assume
	next_saved_file is non-NULL.
	(as_where): Likewise.
---

diff --git a/gas/input-scrub.c b/gas/input-scrub.c
index ae393b66e6f..2ccc2ce9c8e 100644
--- a/gas/input-scrub.c
+++ b/gas/input-scrub.c
@@ -531,14 +531,14 @@ new_logical_line (const char *fname, int line_number)
 void
 as_report_context (void)
 {
-  const struct input_save *saved = next_saved_file;
+  const struct input_save *saved;
   enum expansion expansion = from_sb_expansion;
   int indent = 1;
 
   if (!macro_nest)
     return;
 
-  do
+  for (saved = next_saved_file; saved; saved = saved->next_saved_file)
     {
       if (expansion != expanding_macro)
 	/* Nothing.  */;
@@ -553,7 +553,6 @@ as_report_context (void)
       expansion = saved->from_sb_expansion;
       ++indent;
     }
-  while ((saved = saved->next_saved_file) != NULL);
 }
 
 /* Return the current physical input file name and line number, if known  */
@@ -583,10 +582,10 @@ as_where (unsigned int *linep)
 
   if (macro_nest && is_linefile)
     {
-      const struct input_save *saved = next_saved_file;
+      const struct input_save *saved;
       enum expansion expansion = from_sb_expansion;
 
-      do
+      for (saved = next_saved_file; saved; saved = saved->next_saved_file)
 	{
 	  if (expansion != expanding_macro)
 	    /* Nothing.  */;
@@ -606,7 +605,6 @@ as_where (unsigned int *linep)
 
 	  expansion = saved->from_sb_expansion;
 	}
-      while ((saved = saved->next_saved_file) != NULL);
     }
 
   return file;