Recursion in as_info_where
Alan Modra
amodra@gmail.com
Wed Feb 1 06:36:54 GMT 2023
This function has a gas_assert, ie. possible call to as_abort, which
calls as_report_context, which calls as_info_where. Attached fuzzer
testcase managed to trigger a stack overflow.
* messages.c (as_info_where): Don't gas_assert.
diff --git a/gas/messages.c b/gas/messages.c
index 0db075d779c..7c018acf69f 100644
--- a/gas/messages.c
+++ b/gas/messages.c
@@ -141,8 +141,6 @@ as_info_where (const char *file, unsigned int line, unsigned int indent,
va_list args;
char buffer[2000];
- gas_assert (file != NULL && line > 0 && indent <= INT_MAX);
-
va_start (args, format);
vsnprintf (buffer, sizeof (buffer), format, args);
va_end (args);
--
Alan Modra
Australia Development Lab, IBM
-------------- next part --------------
A non-text attachment was scrubbed...
Name: clusterfuzz-testcase-minimized-fuzz_as-5392730034667520
Type: application/octet-stream
Size: 23 bytes
Desc: not available
URL: <https://sourceware.org/pipermail/binutils/attachments/20230201/0bd99015/attachment-0001.obj>
More information about the Binutils
mailing list