Fix address violation bugs when writing beyond the end of a local string buffer.

	PR 21909
	* prdbg.c (pr_int_type): Increase size of local string buffer.
	(pr_float_type): Likewise.
	(pr_bool_type): Likewise.

diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index c941aee..fa2b367 100644 (file)
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,3 +1,10 @@
+2017-08-08  Nick Clifton  <nickc@redhat.com>
+
+       PR 21909
+       * prdbg.c (pr_int_type): Increase size of local string buffer.
+       (pr_float_type): Likewise.
+       (pr_bool_type): Likewise.
+
 2017-08-02  Nick Clifton  <nickc@redhat.com>
 
        PR 21702

diff --git a/binutils/prdbg.c b/binutils/prdbg.c
index 9bd01bc..7b24fbe 100644 (file)
--- a/binutils/prdbg.c
+++ b/binutils/prdbg.c
@@ -581,7 +581,7 @@ static bfd_boolean
 pr_int_type (void *p, unsigned int size, bfd_boolean unsignedp)
 {
   struct pr_handle *info = (struct pr_handle *) p;
-  char ab[10];
+  char ab[40];
 
   sprintf (ab, "%sint%d", unsignedp ? "u" : "", size * 8);
   return push_type (info, ab);
@@ -593,7 +593,7 @@ static bfd_boolean
 pr_float_type (void *p, unsigned int size)
 {
   struct pr_handle *info = (struct pr_handle *) p;
-  char ab[10];
+  char ab[40];
 
   if (size == 4)
     return push_type (info, "float");
@@ -623,7 +623,7 @@ static bfd_boolean
 pr_bool_type (void *p, unsigned int size)
 {
   struct pr_handle *info = (struct pr_handle *) p;
-  char ab[10];
+  char ab[40];
 
   sprintf (ab, "bool%d", size * 8);