mirror/binutils-gdb
2
0
Fork 0
mirror of https://sourceware.org/git/binutils-gdb.git synced 2025-01-30 12:44:10 +08:00
Code Issues Packages Projects Releases Wiki Activity

Proper bound check in _bfd_doprnt_scan

Browse Source 
While an abort after storing out of bounds by one to an array in our
caller is probably OK in practice, it's better to check before storing.

	PR 22397
	* bfd.c (_bfd_doprnt_scan): Check args index before storing, not
	after.
This commit is contained in:
Alan Modra 2017-11-05 19:52:13 +10:30
parent 7167fe4c70
commit 26a9301057
2 changed files with 12 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
bfd/ChangeLog
View File

@ -1,3 +1,9 @@
2017-11-05 Alan Modra <amodra@gmail.com>
PR 22397
* bfd.c (_bfd_doprnt_scan): Check args index before storing, not
after.
2017-11-05 Alan Modra <amodra@gmail.com> 2017-11-05 Alan Modra <amodra@gmail.com>
PR 22397 PR 22397

12
bfd/bfd.c
View File

@ -974,10 +974,10 @@ _bfd_doprnt_scan (const char *format, union _bfd_doprnt_args *args)
arg_index = *ptr - '1'; arg_index = *ptr - '1';
ptr += 2; ptr += 2;
} }
if (arg_index >= 9)
abort ();
args[arg_index].type = Int; args[arg_index].type = Int;
arg_count++; arg_count++;
if (arg_count > 9)
abort ();
} }
else else
/* Handle explicit numeric value. */ /* Handle explicit numeric value. */
@ -999,10 +999,10 @@ _bfd_doprnt_scan (const char *format, union _bfd_doprnt_args *args)
arg_index = *ptr - '1'; arg_index = *ptr - '1';
ptr += 2; ptr += 2;
} }
if (arg_index >= 9)
abort ();
args[arg_index].type = Int; args[arg_index].type = Int;
arg_count++; arg_count++;
if (arg_count > 9)
abort ();
} }
else else
/* Handle explicit numeric value. */ /* Handle explicit numeric value. */
@ -1032,6 +1032,8 @@ _bfd_doprnt_scan (const char *format, union _bfd_doprnt_args *args)
if ((int) arg_no < 0) if ((int) arg_no < 0)
arg_no = arg_count; arg_no = arg_count;
if (arg_no >= 9)
abort ();
switch (ptr[-1]) switch (ptr[-1])
{ {
case 'd': case 'd':
@ -1100,8 +1102,6 @@ _bfd_doprnt_scan (const char *format, union _bfd_doprnt_args *args)
abort(); abort();
} }
arg_count++; arg_count++;
if (arg_count > 9)
abort ();
} }
} }