cmd/gc: fix heap buffer overflow

Fixes #8528.

LGTM=rsc
R=rsc, r, iant, bradfitz
CC=golang-codereviews
https://golang.org/cl/128230045

diff --git a/src/cmd/gc/bv.c b/src/cmd/gc/bv.c
index 0e8f8d47394771179ed6aa37911a1ae7e6f7e430..cfd1cd2811164a2c08d95440595535f8d3bf82f7 100644 (file)
--- a/src/cmd/gc/bv.c
+++ b/src/cmd/gc/bv.c
@@ -108,6 +108,9 @@ bvnext(Bvec *bv, int32 i)
 {
        uint32 w;
 
+       if(i >= bv->n)
+               return -1;
+
        // Jump i ahead to next word with bits.
        if((bv->b[i>>WORDSHIFT]>>(i&WORDMASK)) == 0) {
                i &= ~WORDMASK;
@@ -117,7 +120,7 @@ bvnext(Bvec *bv, int32 i)
        }
        if(i >= bv->n)
                return -1;
-       
+
        // Find 1 bit.
        w = bv->b[i>>WORDSHIFT]>>(i&WORDMASK);
        while((w&1) == 0) {