avoid overflow of symb buffer in 5a/6a/8a/5c/6c/8c

R=rsc
CC=golang-dev
http://codereview.appspot.com/194099

Committer: Russ Cox <rsc@golang.org>

4 files changed, 42 insertions, 5 deletions

diff --git a/src/cmd/cc/cc.h b/src/cmd/cc/cc.h
index 93b5f8bf7..62a33ae5e 100644
--- a/src/cmd/cc/cc.h
+++ b/src/cmd/cc/cc.h
@@ -492,6 +492,7 @@ EXTERN	int32	nhunk;
 EXTERN	int	ninclude;
 EXTERN	Node*	nodproto;
 EXTERN	Node*	nodcast;
+EXTERN	int32	nsymb;
 EXTERN	Biobuf	outbuf;
 EXTERN	Biobuf	diagbuf;
 EXTERN	char*	outfile;
@@ -500,7 +501,7 @@ EXTERN	int	peekc;
 EXTERN	int32	stkoff;
 EXTERN	Type*	strf;
 EXTERN	Type*	strl;
-EXTERN	char	symb[NSYMB];
+EXTERN	char*	symb;
 EXTERN	Sym*	symstring;
 EXTERN	int	taggen;
 EXTERN	Type*	tfield;
@@ -573,6 +574,7 @@ int	mpatov(char*, vlong*);
  */
 void*	allocn(void*, int32, int32);
 void*	alloc(int32);
+void    ensuresymb(int32);
 void	cinit(void);
 int	compile(char*, char**, int);
 void	errorexit(void);
diff --git a/src/cmd/cc/lex.c b/src/cmd/cc/lex.c
index fd4b0b87b..b722ab15f 100644
--- a/src/cmd/cc/lex.c
+++ b/src/cmd/cc/lex.c
@@ -85,6 +85,7 @@ main(int argc, char *argv[])
 	char *defs[50], *p;
 	int nproc, nout, i, c, ndef;
 
+	ensuresymb(NSYMB);
 	memset(debug, 0, sizeof(debug));
 	tinit();
 	cinit();
@@ -392,7 +393,7 @@ newfile(char *s, int f)
 Sym*
 slookup(char *s)
 {
-
+	ensuresymb(strlen(s));
 	strcpy(symb, s);
 	return lookup();
 }
@@ -408,7 +409,9 @@ lookup(void)
 
 	if((uchar)symb[0] == 0xc2 && (uchar)symb[1] == 0xb7) {
 		// turn leading · into ""·
-		memmove(symb+2, symb, strlen(symb)+1);
+		h = strlen(symb);
+		ensuresymb(h+2);
+		memmove(symb+2, symb, h+1);
 		symb[0] = '"';
 		symb[1] = '"';
 	}
@@ -1584,3 +1587,17 @@ allocn(void *p, int32 n, int32 d)
 		memset((char*)p+n, 0, d);
 	return p;
 }
+
+void
+ensuresymb(int32 n)
+{
+	if(symb == nil) {
+		symb = alloc(NSYMB+1);
+		nsymb = NSYMB;
+	}	
+
+	if(n > nsymb) {
+		symb = allocn(symb, nsymb, n+1-nsymb);
+		nsymb = n;
+	}
+}
diff --git a/src/cmd/cc/lexbody b/src/cmd/cc/lexbody
index c6246e95f..6be2bce92 100644
--- a/src/cmd/cc/lexbody
+++ b/src/cmd/cc/lexbody
@@ -126,6 +126,20 @@ allocn(void *p, int32 on, int32 n)
 }
 
 void
+ensuresymb(int32 n)
+{
+	if(symb == nil) {
+		symb = alloc(NSYMB+1);
+		nsymb = NSYMB;
+	}
+
+	if(n > nsymb) {
+		symb = allocn(symb, nsymb, n+1-nsymb);
+		nsymb = n;
+	}
+}
+
+void
 setinclude(char *p)
 {
 	int i;
@@ -209,7 +223,7 @@ newfile(char *s, int f)
 Sym*
 slookup(char *s)
 {
-
+	ensuresymb(strlen(s));
 	strcpy(symb, s);
 	return lookup();
 }
@@ -225,7 +239,9 @@ lookup(void)
 
 	if((uchar)symb[0] == 0xc2 && (uchar)symb[1] == 0xb7) {
 		// turn leading · into ""·
-		memmove(symb+2, symb, strlen(symb)+1);
+		h = strlen(symb);
+		ensuresymb(h+2);
+		memmove(symb+2, symb, h+1);
 		symb[0] = '"';
 		symb[1] = '"';
 	}
diff --git a/src/cmd/cc/macbody b/src/cmd/cc/macbody
index 21d69bcc7..7d3acaa8e 100644
--- a/src/cmd/cc/macbody
+++ b/src/cmd/cc/macbody
@@ -140,6 +140,7 @@ dodefine(char *cp)
 	char *p;
 	int32 l;
 
+	ensuresymb(strlen(cp));
 	strcpy(symb, cp);
 	p = strchr(symb, '=');
 	if(p) {
@@ -574,6 +575,7 @@ macinc(void)
 	for(i=0; i<ninclude; i++) {
 		if(i == 0 && c0 == '>')
 			continue;
+		ensuresymb(strlen(include[i])+strlen(str)+2);
 		strcpy(symb, include[i]);
 		strcat(symb, "/");
 		if(strcmp(symb, "./") == 0)