[RISCV] Use after free in gas/config/tc-riscv.c: riscv_set_arch()

[Klaus Kruse Pedersen (Klaus)]

The code below will pass a pointer to a free'd string to as_fatal()
when more than one extension is been specified:

 151 const char *extension = NULL;
[...]
 187   while (*p)
 188     {
 189       if (*p == 'x')
 190         {
 191           char *subset = xstrdup (p), *q = subset;
 192 
 193           while (*++q != '\0' && *q != '_')
 194             ;
 195           *q = '\0';
 196 
 197           if (extension)
 198             as_fatal ("-march=%s: only one non-standard extension
is supported"
 199                       " (found `%s' and `%s')", s, extension,
subset);

Problem is here:

 200           extension = subset;
 201           riscv_add_subset (subset);
 202           p += strlen (subset);
 203           free (subset);
 204         }
[...]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=blob;f=gas/c
onfig/tc-
riscv.c;h=55c41c5db3c9240e8da3cdf8906cfb745d041c6f;hb=HEAD#l187