Control: tags -1 + fixed-upstream patch Hi,
The upstream issue (#203) was closed by this commit, which landed one day after the nasm-3.02 tag. No release contains it yet: https://www.google.com/url?q=https://github.com/netwide-assembler/nasm/commit/8890d723d0aa9ed1a790e2ce1c55eee8dfa0cf94&source=gmail&ust=1793766184534000&sa=E "outobj: fix buffer overflow when too many segments in a group" (Nick Clifton, Signed-off-by H. Peter Anvin) --- a/output/outobj.c +++ b/output/outobj.c @@ -1737,6 +1737,10 @@ obj_directive(enum directive directive, char *value) */ continue; } + if (grp->nentries >= GROUP_MAX) { + nasm_nonfatal("too many segments in a group"); + return DIRR_ERROR; + } for (seg = seghead; seg; seg = seg->next) if (!strcmp(seg->name, p)) break; The check covers both paths that append to grp->segs[] (known segment and as-yet-undefined segment). Each adds exactly one entry, and both come after the new check. Verified on the Debian 3.01-1 source. The patch applies with a -1 line offset. Both builds use -fsanitize=address: - "group g1 s0 s1 ... s299" (300 names, GROUP_MAX is 256) with -f obj: unpatched: AddressSanitizer heap-buffer-overflow, WRITE of size 8 in obj_directive output/outobj.c:1765 patched: "error: too many segments in a group", no ASan report - A 3-segment group, and exactly 256 defined segments in one group, both assemble cleanly on both builds and produce byte-identical .obj files. So the boundary case still works and normal output is unchanged. Since trixie is marked "postponed (revisit when fixed upstream)", this one-line backport may be worth picking up there too. Thanks!
