aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorNick Clifton <nickc@redhat.com>2019-09-03 15:37:12 +0100
committerNick Clifton <nickc@redhat.com>2019-09-03 15:37:12 +0100
commitf44b758d3133ef0a7f3131c1e12ed20feb33ee61 (patch)
tree90a04255f6557a078df9a4c0b4819468e3de6870
parentFix a potential buffer overrun in the MMIX disassembler when processing a cor... (diff)
downloadbinutils-gdb-f44b758d3133ef0a7f3131c1e12ed20feb33ee61.tar.gz
binutils-gdb-f44b758d3133ef0a7f3131c1e12ed20feb33ee61.tar.bz2
binutils-gdb-f44b758d3133ef0a7f3131c1e12ed20feb33ee61.zip
Fix buffer underrun bug in the TI C30 disassembler.
PR 24961 * tic30-dis.c (get_indirect_operand): Check for bufcnt being greater than zero before indexing via (bufcnt -1).
-rw-r--r--opcodes/ChangeLog6
-rw-r--r--opcodes/tic30-dis.c4
2 files changed, 9 insertions, 1 deletions
diff --git a/opcodes/ChangeLog b/opcodes/ChangeLog
index 87e3f74663d..64b6a07ac49 100644
--- a/opcodes/ChangeLog
+++ b/opcodes/ChangeLog
@@ -1,5 +1,11 @@
2019-09-03 Nick Clifton <nickc@redhat.com>
+ PR 24961
+ * tic30-dis.c (get_indirect_operand): Check for bufcnt being
+ greater than zero before indexing via (bufcnt -1).
+
+2019-09-03 Nick Clifton <nickc@redhat.com>
+
PR 24958
* mmix-dis.c (MAX_REG_NAME_LEN): Define.
(MAX_SPEC_REG_NAME_LEN): Define.
diff --git a/opcodes/tic30-dis.c b/opcodes/tic30-dis.c
index c64aceb29fa..668c519df87 100644
--- a/opcodes/tic30-dis.c
+++ b/opcodes/tic30-dis.c
@@ -253,7 +253,9 @@ get_indirect_operand (unsigned short fragment,
for (i = 0, bufcnt = 0; i < len; i++, bufcnt++)
{
buffer[bufcnt] = current_ind->syntax[i];
- if (buffer[bufcnt - 1] == 'a' && buffer[bufcnt] == 'r')
+ if (bufcnt > 0
+ && buffer[bufcnt - 1] == 'a'
+ && buffer[bufcnt] == 'r')
buffer[++bufcnt] = arnum + '0';
if (buffer[bufcnt] == '('
&& current_ind->displacement == DISP_REQUIRED)