diff options
| author | Michael Forney <mforney@mforney.org> | 2019-04-10 18:17:37 +0930 |
|---|---|---|
| committer | Alan Modra <amodra@gmail.com> | 2019-04-10 18:30:29 +0930 |
| commit | b05971a652c35ed72d3c95290e18d8f6e4ef6c46 (patch) | |
| tree | 5cd494ca89638f957e99efcf3f16ee6c52e5e7d9 /bfd/doc | |
| parent | a5def729be2596496aec225e843903b25c672e01 (diff) | |
| download | binutils-gdb-b05971a652c35ed72d3c95290e18d8f6e4ef6c46.tar.gz | |
PR24427, bfd/doc/chew.c reads uninitialized memory and subtracts from function pointer
PR 24427
* doc/chew.c (free_words): Correctly free "push_text" strings.
Diffstat (limited to 'bfd/doc')
| -rw-r--r-- | bfd/doc/chew.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/bfd/doc/chew.c b/bfd/doc/chew.c index c3dd9b444bf..ef5a22c2fa5 100644 --- a/bfd/doc/chew.c +++ b/bfd/doc/chew.c @@ -1260,11 +1260,11 @@ free_words (void) if (ptr->code) { int i; - for (i = 0; i < ptr->code_length; i ++) + for (i = 0; i < ptr->code_end - 1; i ++) if (ptr->code[i] == push_text && ptr->code[i + 1]) { - free (ptr->code[i + 1] - 1); + free ((char *) ptr->code[i + 1] - 1); ++ i; } free (ptr->code); |