2009-02-25 Laurent GUERBY <laurent@guerby.net>

        * a-teioed.adb (Expand): Fix Result overflow.



git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/trunk@144427 138bc75d-0d04-0410-961f-82ee72b054a4

1 files changed, 8 insertions, 0 deletions

diff --git a/gcc/ada/a-teioed.adb b/gcc/ada/a-teioed.adb
index a5c2b662e36..081cef6fa06 100644
--- a/gcc/ada/a-teioed.adb
+++ b/gcc/ada/a-teioed.adb
@@ -84,6 +84,10 @@ package body Ada.Text_IO.Editing is
                --  character has already been made, so a count of one is a
                --  no-op, and a count of zero erases a character.
 
+               if Result_Index + Count - 2 > Result'Last then
+                  raise Picture_Error;
+               end if;
+
                for J in 2 .. Count loop
                   Result (Result_Index + J - 2) := Picture (Picture_Index - 1);
                end loop;
@@ -98,6 +102,10 @@ package body Ada.Text_IO.Editing is
                raise Picture_Error;
 
             when others =>
+               if Result_Index > Result'Last then
+                  raise Picture_Error;
+               end if;
+
                Result (Result_Index) := Picture (Picture_Index);
                Picture_Index := Picture_Index + 1;
                Result_Index := Result_Index + 1;