This is the mail archive of the gcc-patches@gcc.gnu.org mailing list for the GCC project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]

fix for cpplex.c


Hi
Another bug that shows during Crystal Space engine compilation is crash in cpp.
I found hard to contruct some testcase for cpp, but the problem is quite easy
to understand.  The _cpp_stan_line calls auto_expand_name_space when name space
allocated is small.  The auto_expand automatically expands by one half of
previous size, but the amount needed by _cpp_scan_line can be greater resulting
in overwriting the memory past end of the allocated block and crash later
elsewhere in random memory allocation.

I've fixed this by changing auto_expand_name_space to accept
one extra parameter for minimum space allocated.  Other calls
to this macro don't seems to require it, but I think that someone
more familiar with the cpplex sources will find usage for it :)

Honza

Wed Apr 26 21:17:18 CEST 2000  Jan Hubicka  <jh@suse.cz>
	* cpplex.c (auto_expand_call): Add extra argument "min".
	(_cpp_scan_line): Fix memory allocation problem.
	(parse_name, parse_number, parse_string, cpp_lex_line): Update call
	to auto_expand_call.

*** cpplex.c.old	Wed Apr 26 21:13:18 2000
--- cpplex.c	Wed Apr 26 21:14:34 2000
*************** static void init_token_list	PARAMS ((cpp
*** 61,68 ****
  static void pedantic_whitespace	PARAMS ((cpp_reader *, U_CHAR *,
  					 unsigned int));
  
! #define auto_expand_name_space(list) \
!     expand_name_space ((list), (list)->name_cap / 2)
  
  /* Re-allocates PFILE->token_buffer so it will hold at least N more chars.  */
  
--- 61,68 ----
  static void pedantic_whitespace	PARAMS ((cpp_reader *, U_CHAR *,
  					 unsigned int));
  
! #define auto_expand_name_space(list, min) \
!     expand_name_space ((list), MAX ((list)->name_cap / 2, min))
  
  /* Re-allocates PFILE->token_buffer so it will hold at least N more chars.  */
  
*************** _cpp_scan_line (pfile, list)
*** 532,538 ****
        if (list->tokens_used >= list->tokens_cap)
  	expand_token_space (list);
        if (list->name_used + len >= list->name_cap)
! 	auto_expand_name_space (list);
  
        if (type == CPP_MACRO)
  	type = CPP_NAME;
--- 532,538 ----
        if (list->tokens_used >= list->tokens_cap)
  	expand_token_space (list);
        if (list->name_used + len >= list->name_cap)
! 	auto_expand_name_space (list, len);
  
        if (type == CPP_MACRO)
  	type = CPP_NAME;
*************** parse_name (pfile, list, name)
*** 2523,2529 ****
    if (cur < buffer->rlimit)
      {
        list->name_used = namebuf - list->namebuf;
!       auto_expand_name_space (list);
        goto expanded;
      }
  
--- 2523,2529 ----
    if (cur < buffer->rlimit)
      {
        list->name_used = namebuf - list->namebuf;
!       auto_expand_name_space (list, 1);
        goto expanded;
      }
  
*************** parse_number (pfile, list, name)
*** 2573,2579 ****
    if (cur < buffer->rlimit)
      {
        list->name_used = namebuf - list->namebuf;
!       auto_expand_name_space (list);
        goto expanded;
      }
    
--- 2573,2579 ----
    if (cur < buffer->rlimit)
      {
        list->name_used = namebuf - list->namebuf;
!       auto_expand_name_space (list, 1);
        goto expanded;
      }
    
*************** parse_string (pfile, list, name, termina
*** 2694,2700 ****
    if (cur < buffer->rlimit)
      {
        list->name_used = namebuf - list->namebuf;
!       auto_expand_name_space (list);
        goto expanded;
      }
  
--- 2694,2700 ----
    if (cur < buffer->rlimit)
      {
        list->name_used = namebuf - list->namebuf;
!       auto_expand_name_space (list, 1);
        goto expanded;
      }
  
*************** _cpp_lex_line (pfile, list)
*** 2823,2829 ****
  	    {
  	      cur_token--;
  	      if (list->name_cap == list->name_used)
! 		auto_expand_name_space (list);
  
  	      cur_token->val.name.len = 1;
  	      cur_token->val.name.offset = list->name_used;
--- 2823,2829 ----
  	    {
  	      cur_token--;
  	      if (list->name_cap == list->name_used)
! 		auto_expand_name_space (list, 1);
  
  	      cur_token->val.name.len = 1;
  	      cur_token->val.name.offset = list->name_used;

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]