[binutils-gdb] More bounds checking in macro_expand

[Alan Modra]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=6e1ee99772d2f0c07b4a2c65f3c1593fbf55d9c1

commit 6e1ee99772d2f0c07b4a2c65f3c1593fbf55d9c1
Author: Alan Modra <amodra@gmail.com>
Date:   Thu Mar 2 08:12:00 2023 +1030

    More bounds checking in macro_expand
    
            * macro.c (macro_expand): Ensure input string buffer is not
            read past end.

Diff:
---
 gas/macro.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/gas/macro.c b/gas/macro.c
index 74a1317cb11..fae94ae42c1 100644
--- a/gas/macro.c
+++ b/gas/macro.c
@@ -1120,7 +1120,7 @@ macro_expand (size_t idx, sb *in, macro_entry *m, sb *out)
 	     then the actual stuff.  */
 	  sb_reset (&t);
 	  idx = get_token (idx, in, &t);
-	  if (in->ptr[idx] != '=')
+	  if (idx >= in->len || in->ptr[idx] != '=')
 	    {
 	      err = _("confusion in formal parameters");
 	      break;
@@ -1184,7 +1184,7 @@ macro_expand (size_t idx, sb *in, macro_entry *m, sb *out)
 
 	  if (f->type != FORMAL_VARARG)
 	    idx = get_any_string (idx, in, &f->actual);
-	  else
+	  else if (idx < in->len)
 	    {
 	      sb_add_buffer (&f->actual, in->ptr + idx, in->len - idx);
 	      idx = in->len;
@@ -1202,9 +1202,9 @@ macro_expand (size_t idx, sb *in, macro_entry *m, sb *out)
 	idx = sb_skip_comma (idx, in);
       else
 	{
-	  if (in->ptr[idx] == ',')
+	  if (idx < in->len && in->ptr[idx] == ',')
 	    ++idx;
-	  if (ISWHITE (in->ptr[idx]))
+	  if (idx < in->len && ISWHITE (in->ptr[idx]))
 	    break;
 	}
     }