Report
binutils opcodes/csky-dis.c: unbounded strcat/sprintf into fixed buffers in operand printing
bc799ef1-8772-41c9-bd5d-a0e99e69c8ba
In the C-SKY disassembler (opcodes/csky-dis.c), multiple code paths build disassembly text by repeatedly calling sprintf()/strcat() into fixed-size stack buffers (char str[256], char buf[128]) without any bounds checking. The total length written into str depends on instruction decoding and on register/control-symbol names returned by get_gr_name()/get_cr_name(). If these strings are long enough (or if formatting expands beyond expected size), the code can write past the end of str/buf causing memory corruption.