diff options
| author | grischka <grischka> | 2008-12-02 02:34:58 +0100 |
|---|---|---|
| committer | grischka <grischka> | 2008-12-02 02:36:27 +0100 |
| commit | 7c3f19c079afcea8c07e571dd07f7ef03de86b8e (patch) | |
| tree | 4579389e14edf9bfb1e3e44f4d6b20368da8ed7c | |
| parent | aa8d22e38ef83c097b7ff7c13926d583d65b7be1 (diff) | |
| download | tinycc-7c3f19c079afcea8c07e571dd07f7ef03de86b8e.tar.gz tinycc-7c3f19c079afcea8c07e571dd07f7ef03de86b8e.tar.bz2 | |
fix data overflow with init_putv
The simplest code to reproduce this bug seems to be
int a[][] = {{1,1,1,1,1,1,1}};
| -rw-r--r-- | tcc.c | 4 |
1 files changed, 4 insertions, 0 deletions
@@ -8808,6 +8808,10 @@ static void init_putv(CType *type, Section *sec, unsigned long c, /* XXX: generate error if incorrect relocation */ gen_assign_cast(&dtype); bt = type->t & VT_BTYPE; + /* we'll write at most 12 bytes */ + if (c + 12 > sec->data_allocated) { + section_realloc(sec, c + 12); + } ptr = sec->data + c; /* XXX: make code faster ? */ if (!(type->t & VT_BITFIELD)) { |
