Article View: gnu.gcc.bug
Article #1591more problems with signed char index array violations in GCC 2.3.3 cpp
From: Paul Eggert
Date: Wed, 06 Jan 1993 02:49
Date: Wed, 06 Jan 1993 02:49
91 lines
3076 bytes
3076 bytes
I looked for more array bound violations in cpp (GCC 2.3.3) and found four
places in cccp.c where (on a machine where char is signed) a negative value
might be used as a subscript, leading to possibly wrong answers and/or core
dumps. Here is a patch.
Wed Jan 6 02:35:23 1993 Paul Eggert (eggert@twinsun.com)
* cccp.c (check_preconditions, do_error, do_warning, do_xifdef):
Don't use signed chars to index into arrays; they might be negative.
===================================================================
RCS file: RCS/cccp.c,v
retrieving revision 2.3
diff -c -r2.3 cccp.c
*** cccp.c 1992/12/16 04:25:36 2.3
--- cccp.c 1993/01/06 02:35:23
***************
*** 4383,4392 ****
int len;
prec += 5;
! while (is_hor_space[*prec])
prec++;
name = prec;
! while (is_idchar[*prec])
prec++;
len = prec - name;
--- 4383,4392 ----
int len;
prec += 5;
! while (is_hor_space[(U_CHAR) *prec])
prec++;
name = prec;
! while (is_idchar[(U_CHAR) *prec])
prec++;
len = prec - name;
***************
*** 5827,5833 ****
struct directive *keyword;
{
int length = limit - buf;
! char *copy = (char *) xmalloc (length + 1);
bcopy (buf, copy, length);
copy[length] = 0;
SKIP_WHITE_SPACE (copy);
--- 5827,5833 ----
struct directive *keyword;
{
int length = limit - buf;
! U_CHAR *copy = (U_CHAR *) xmalloc (length + 1);
bcopy (buf, copy, length);
copy[length] = 0;
SKIP_WHITE_SPACE (copy);
***************
*** 5850,5856 ****
struct directive *keyword;
{
int length = limit - buf;
! char *copy = (char *) xmalloc (length + 1);
bcopy (buf, copy, length);
copy[length] = 0;
SKIP_WHITE_SPACE (copy);
--- 5850,5856 ----
struct directive *keyword;
{
int length = limit - buf;
! U_CHAR *copy = (U_CHAR *) xmalloc (length + 1);
bcopy (buf, copy, length);
copy[length] = 0;
SKIP_WHITE_SPACE (copy);
***************
*** 6094,6100 ****
if (ip->fname != 0 && keyword->type == T_IFNDEF) {
U_CHAR *p = ip->buf;
while (p != directive_start) {
! char c = *p++;
if (is_space[c])
;
else if (c == '/' && p != ip->bufp && *p == '*') {
--- 6094,6100 ----
if (ip->fname != 0 && keyword->type == T_IFNDEF) {
U_CHAR *p = ip->buf;
while (p != directive_start) {
! U_CHAR c = *p++;
if (is_space[c])
;
else if (c == '/' && p != ip->bufp && *p == '*') {
Technical Details
Message-ID:
<9301060249.AA11652@farside.twinsun.com>Path:
arc1-ca.pugleaf.net!sparky!uunet!zaphod.mps.ohio-state.edu!cis.ohio-state.edu!twinsun.COM!eggertShow Full Headers
Complete Article Headers
Newsgroups: gnu.gcc.bug Path: arc1-ca.pugleaf.net!sparky!uunet!zaphod.mps.ohio-state.edu!cis.ohio-state.edu!twinsun.COM!eggert From: eggert@twinsun.COM (Paul Eggert) Subject: more problems with signed char index array violations in GCC 2.3.3 cpp Message-ID: <9301060249.AA11652@farside.twinsun.com> Sender: gnulists@ai.mit.edu Organization: GNUs Not Usenet Distribution: gnu Date: Wed, 6 Jan 1993 02:49:13 GMT Approved: bug-gcc@prep.ai.mit.edu Lines: 92