[ There's at least one more port that has the exact same problem. ]

stormy16's ctor/dtor output routines have this:

  char buf[16];

     sprintf (buf, ".ctors.%.5u",
               /* Invert the numbering so the linker puts us in the proper
                  order; constructors are run from right to left, and the
                  linker sorts in increasing order.  */
               MAX_INIT_PRIORITY - priority);

Which can overflow if depending on MAX_INIT_PRIORITY - priority. The given formatting string does _not_ limit the total number of characters printed! If that was the intent, the formatting string is wrong.

Anyway, the fix is trivial, increase the buffer.  Installed on the trunk.

Jeff

commit 41beb61397a504733a64fc6ad317d657f6b556c5
Author: law <law@138bc75d-0d04-0410-961f-82ee72b054a4>
Date:   Wed Oct 26 15:36:48 2016 +0000

        * config/stormy16/stormy16.c (xstormy16_asm_output_destrutor): Increase
        buffer size.
        (xstormy16_asm_output_constructor): Likewise.
    
    git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/trunk@241564 
138bc75d-0d04-0410-961f-82ee72b054a4

diff --git a/gcc/ChangeLog b/gcc/ChangeLog
index 7d869b1..d778e95 100644
--- a/gcc/ChangeLog
+++ b/gcc/ChangeLog
@@ -1,5 +1,9 @@
 2016-10-26  Jeff Law  <l...@redhat.com>
 
+       * config/stormy16/stormy16.c (xstormy16_asm_output_destrutor): Increase
+       buffer size.
+       (xstormy16_asm_output_constructor): Likewise.
+
        * config/pa/pa.c (pa_asm_output_mi_thunk): Increase buffer
        size.
 
diff --git a/gcc/config/stormy16/stormy16.c b/gcc/config/stormy16/stormy16.c
index 531a7e9..f74b4d9 100644
--- a/gcc/config/stormy16/stormy16.c
+++ b/gcc/config/stormy16/stormy16.c
@@ -1618,7 +1618,7 @@ static void
 xstormy16_asm_out_destructor (rtx symbol, int priority)
 {
   const char *section = ".dtors";
-  char buf[16];
+  char buf[18];
 
   /* ??? This only works reliably with the GNU linker.  */
   if (priority != DEFAULT_INIT_PRIORITY)
@@ -1640,7 +1640,7 @@ static void
 xstormy16_asm_out_constructor (rtx symbol, int priority)
 {
   const char *section = ".ctors";
-  char buf[16];
+  char buf[18];
 
   /* ??? This only works reliably with the GNU linker.  */
   if (priority != DEFAULT_INIT_PRIORITY)

Reply via email to