diff --git a/gas/ChangeLog b/gas/ChangeLog
index 2b74b6b4a2e..4a5b6719ec0 100644
--- a/gas/ChangeLog
+++ b/gas/ChangeLog
@@ -1,3 +1,9 @@
+2002-11-18  Alexandre Oliva  <aoliva@redhat.com>
+
+	* config/tc-mips.c (s_change_section): Make sure input buffer
+	is not accessed past the end.  Don't hand
+	obj_elf_change_section a pointer into the input buffer.
+
 2002-11-18  Alexandre Oliva  <aoliva@redhat.com>, Chris Demetriou  <cgd@broadcom.com>
 
 	* config/tc-mips.c (tc_gen_reloc): Fix typo in handling of
diff --git a/gas/config/tc-mips.c b/gas/config/tc-mips.c
index 611e775283c..02e9e9f1a8e 100644
--- a/gas/config/tc-mips.c
+++ b/gas/config/tc-mips.c
@@ -11657,7 +11657,8 @@ s_change_section (ignore)
 
   section_name = input_line_pointer;
   c = get_symbol_end ();
-  next_c = *(input_line_pointer + 1);
+  if (c)
+    next_c = *(input_line_pointer + 1);
 
   /* Do we have .section Name<,"flags">?  */
   if (c != ',' || (c == ',' && next_c == '"'))
@@ -11688,8 +11689,13 @@ s_change_section (ignore)
   else
     section_alignment = 0;
 
+  section_name = xstrdup (section_name);
+
   obj_elf_change_section (section_name, section_type, section_flag,
 			  section_entry_size, 0, 0, 0);
+
+  if (now_seg->name != section_name)
+    free (section_name);
 #endif /* OBJ_ELF */
 }