This is the mail archive of the
binutils@sourceware.org
mailing list for the binutils project.
Re: PATCH: Fix buffer overflow in gas
On Tue, May 02, 2006 at 06:31:30AM -0700, H. J. Lu wrote:
> On Tue, May 02, 2006 at 10:47:27AM +0100, Nick Clifton wrote:
> > Hi H. J.
> >
> > >There are some potential buffer overflows in gas. 8byte isn't enough
> > >to hold a negative byte. This patch fixes them. Also we should use
> > >snprintf instead of sprintf.
> >
> > Did you test this patch ? if so, please could you say how.
>
> You can put some none ascii char in assembly code.
>
> >
> > >2006-05-01 H.J. Lu <hongjiu.lu@intel.com>
> > >
> > > * config/tc-i386.c (output_invalid_buf): Change size to 16.
> > > * config/tc-tic30.c (output_invalid_buf): Likewise.
> > >
> > > * config/tc-i386.c (output_invalid): Use snprintf instead of
> > > sprintf.
> > > * config/tc-ia64.c (declare_register_set): Likewise.
> > > (emit_one_bundle): Likewise.
> > > (check_dependencies): Likewise.
> > > * config/tc-tic30.c (output_invalid): Likewise.
> >
> > Assuming that you have tested the targets involved and that there were
> > no regressions then this patch is approved.
>
> Done.
>
Jan suggested we should cast int to unsigned char.
foo.s:20: Error: invalid character (0xd6) in mnemonic
is better than
foo.s:20: Error: invalid character (0xfffffffd6) in mnemonic
I will check it in.
H.J.
---
2006-05-02 H.J. Lu <hongjiu.lu@intel.com>
Jan Beulich <jbeulich@novell.com>
* config/tc-i386.c (output_invalid_buf): Change size for
unsigned char.
* config/tc-tic30.c (output_invalid_buf): Likewise.
* config/tc-i386.c (output_invalid): Cast none-ascii char to
unsigned char.
* config/tc-tic30.c (output_invalid): Likewise.
--- gas/config/tc-i386.c.buf 2006-05-02 06:50:00.000000000 -0700
+++ gas/config/tc-i386.c 2006-05-02 07:12:03.000000000 -0700
@@ -5251,7 +5251,7 @@ md_atof (type, litP, sizeP)
return 0;
}
-static char output_invalid_buf[16];
+static char output_invalid_buf[sizeof (unsigned char) * 2 + 6];
static char *
output_invalid (c)
@@ -5262,7 +5262,7 @@ output_invalid (c)
"'%c'", c);
else
snprintf (output_invalid_buf, sizeof (output_invalid_buf),
- "(0x%x)", (unsigned) c);
+ "(0x%x)", (unsigned char) c);
return output_invalid_buf;
}
--- gas/config/tc-tic30.c.buf 2006-05-02 06:50:00.000000000 -0700
+++ gas/config/tc-tic30.c 2006-05-02 07:12:11.000000000 -0700
@@ -273,7 +273,7 @@ struct tic30_insn
struct tic30_insn insn;
static int found_parallel_insn;
-static char output_invalid_buf[16];
+static char output_invalid_buf[sizeof (unsigned char) * 2 + 6];
static char *
output_invalid (char c)
@@ -283,7 +283,7 @@ output_invalid (char c)
"'%c'", c);
else
snprintf (output_invalid_buf, sizeof (output_invalid_buf),
- "(0x%x)", (unsigned) c);
+ "(0x%x)", (unsigned char) c);
return output_invalid_buf;
}
2006-05-02 H.J. Lu <hongjiu.lu@intel.com>
* config/tc-i386.c (output_invalid_buf): Change size for
unsigned char.
* config/tc-tic30.c (output_invalid_buf): Likewise.
* config/tc-i386.c (output_invalid): Cast none-ascii char to
unsigned char.
* config/tc-tic30.c (output_invalid): Likewise.
--- gas/config/tc-i386.c.buf 2006-05-02 06:50:00.000000000 -0700
+++ gas/config/tc-i386.c 2006-05-02 07:12:03.000000000 -0700
@@ -5251,7 +5251,7 @@ md_atof (type, litP, sizeP)
return 0;
}
-static char output_invalid_buf[16];
+static char output_invalid_buf[sizeof (unsigned char) * 2 + 6];
static char *
output_invalid (c)
@@ -5262,7 +5262,7 @@ output_invalid (c)
"'%c'", c);
else
snprintf (output_invalid_buf, sizeof (output_invalid_buf),
- "(0x%x)", (unsigned) c);
+ "(0x%x)", (unsigned char) c);
return output_invalid_buf;
}
--- gas/config/tc-tic30.c.buf 2006-05-02 06:50:00.000000000 -0700
+++ gas/config/tc-tic30.c 2006-05-02 07:12:11.000000000 -0700
@@ -273,7 +273,7 @@ struct tic30_insn
struct tic30_insn insn;
static int found_parallel_insn;
-static char output_invalid_buf[16];
+static char output_invalid_buf[sizeof (unsigned char) * 2 + 6];
static char *
output_invalid (char c)
@@ -283,7 +283,7 @@ output_invalid (char c)
"'%c'", c);
else
snprintf (output_invalid_buf, sizeof (output_invalid_buf),
- "(0x%x)", (unsigned) c);
+ "(0x%x)", (unsigned char) c);
return output_invalid_buf;
}