diff --git a/include/ChangeLog b/include/ChangeLog
index 22df3662d8..ac58c8275a 100644
--- a/include/ChangeLog
+++ b/include/ChangeLog
@@ -1,3 +1,10 @@
+2005-07-03  Steve Ellcey  <sje@cup.hp.com>
+
+	PR other/13906
+	* ansidecl.h (ATTRIBUTE_ALIGNED_ALIGNOF): New.
+	* md5.h (md5_uintptr): New.
+	(md5_ctx): Align buffer field.
+
 2005-06-30  Daniel Berlin  <dberlin@dberlin.org>
 
 	* hashtab.h (HTAB_DELETED_ENTRY): New macro.
diff --git a/include/ansidecl.h b/include/ansidecl.h
index 439431182d..a1a765d63f 100644
--- a/include/ansidecl.h
+++ b/include/ansidecl.h
@@ -352,6 +352,15 @@ So instead we use the macro below and test it against specific values.  */
 # endif /* GNUC >= 3.5 */
 #endif /* ATTRIBUTE_SENTINEL */
 
+
+#ifndef ATTRIBUTE_ALIGNED_ALIGNOF
+# if (GCC_VERSION >= 3000)
+#  define ATTRIBUTE_ALIGNED_ALIGNOF(m) __attribute__ ((__aligned__ (__alignof__ (m))))
+# else
+#  define ATTRIBUTE_ALIGNED_ALIGNOF(m)
+# endif /* GNUC >= 3.0 */
+#endif /* ATTRIBUTE_ALIGNED_ALIGNOF */
+
 /* We use __extension__ in some places to suppress -pedantic warnings
    about GCC extensions.  This feature didn't work properly before
    gcc 2.8.  */
diff --git a/include/md5.h b/include/md5.h
index 655933f753..e35789346b 100644
--- a/include/md5.h
+++ b/include/md5.h
@@ -37,6 +37,7 @@
 #ifdef _LIBC
 # include <sys/types.h>
 typedef u_int32_t md5_uint32;
+typedef uintptr_t md5_uintptr;
 #else
 #  define INT_MAX_32_BITS 2147483647
 
@@ -64,6 +65,9 @@ typedef u_int32_t md5_uint32;
 #   endif
 #  endif
 # endif
+/* We have to make a guess about the integer type equivalent in size
+   to pointers which should always be correct.  */
+typedef unsigned long int md5_uintptr;
 #endif
 
 /* Structure to save state of computation between the single steps.  */
@@ -76,7 +80,7 @@ struct md5_ctx
 
   md5_uint32 total[2];
   md5_uint32 buflen;
-  char buffer[128];
+  char buffer[128] ATTRIBUTE_ALIGNED_ALIGNOF(md5_uint32);
 };
 
 /*
diff --git a/libiberty/ChangeLog b/libiberty/ChangeLog
index 2522b8270e..ba575549ad 100644
--- a/libiberty/ChangeLog
+++ b/libiberty/ChangeLog
@@ -1,3 +1,15 @@
+2005-07-03  Steve Ellcey  <sje@cup.hp.com>
+
+	PR other/13906
+	* md5.c (md5_process_bytes): Check alignment.
+
+2005-07-01  Ian Lance Taylor  <ian@airs.com>
+
+	PR other/22268
+	* cp-demangle.c (d_expr_primary): Don't run off the end of the
+	string while looking for the end of a literal value.
+	* testsuite/demangle-expected: Add test case.
+
 2005-06-30  Daniel Berlin  <dberlin@dberlin.org>
 
 	* hashtab.c (EMPTY_ENTRY): Moved and renamed.
diff --git a/libiberty/cp-demangle.c b/libiberty/cp-demangle.c
index 6174439072..8f1cfb17f8 100644
--- a/libiberty/cp-demangle.c
+++ b/libiberty/cp-demangle.c
@@ -2337,7 +2337,11 @@ d_expr_primary (struct d_info *di)
 	}
       s = d_str (di);
       while (d_peek_char (di) != 'E')
-	d_advance (di, 1);
+	{
+	  if (d_peek_char (di) == '\0')
+	    return NULL;
+	  d_advance (di, 1);
+	}
       ret = d_make_comp (di, t, type, d_make_name (di, s, d_str (di) - s));
     }
   if (d_next_char (di) != 'E')
diff --git a/libiberty/md5.c b/libiberty/md5.c
index c03a74dffa..83e0beb339 100644
--- a/libiberty/md5.c
+++ b/libiberty/md5.c
@@ -223,6 +223,23 @@ md5_process_bytes (const void *buffer, size_t len, struct md5_ctx *ctx)
   /* Process available complete blocks.  */
   if (len > 64)
     {
+#if !_STRING_ARCH_unaligned
+/* To check alignment gcc has an appropriate operator.  Other
+   compilers don't.  */
+# if __GNUC__ >= 2
+#  define UNALIGNED_P(p) (((md5_uintptr) p) % __alignof__ (md5_uint32) != 0)
+# else
+#  define UNALIGNED_P(p) (((md5_uintptr) p) % sizeof (md5_uint32) != 0)
+# endif
+      if (UNALIGNED_P (buffer))
+        while (len > 64)
+          {
+            md5_process_block (memcpy (ctx->buffer, buffer, 64), 64, ctx);
+            buffer = (const char *) buffer + 64;
+            len -= 64;
+          }
+      else
+#endif
       md5_process_block (buffer, len & ~63, ctx);
       buffer = (const void *) ((const char *) buffer + (len & ~63));
       len &= 63;
diff --git a/libiberty/testsuite/demangle-expected b/libiberty/testsuite/demangle-expected
index f8e402d01b..4526773a78 100644
--- a/libiberty/testsuite/demangle-expected
+++ b/libiberty/testsuite/demangle-expected
@@ -3704,6 +3704,12 @@ foo<int (*) [3]>
 _ZN13PatternDriver23StringScalarDeleteValueC1ERKNS_25ConflateStringScalarValueERKNS_25AbstractStringScalarValueERKNS_12TemplateEnumINS_12pdcomplementELZNS_16complement_namesEELZNS_14COMPLEMENTENUMEEEE
 _ZN13PatternDriver23StringScalarDeleteValueC1ERKNS_25ConflateStringScalarValueERKNS_25AbstractStringScalarValueERKNS_12TemplateEnumINS_12pdcomplementELZNS_16complement_namesEELZNS_14COMPLEMENTENUMEEEE
 PatternDriver::StringScalarDeleteValue::StringScalarDeleteValue
+#
+# This used to cause the demangler to walk into undefined memory--PR 22268
+--format=gnu-v3 --no-params
+ALsetchannels
+ALsetchannels
+ALsetchannels
 # Test GNU V3 constructor and destructor identification.
 # 0 means it is not a constructor/destructor.
 # Other integers correspond to enum gnu_v3_{c,d}tor_kinds in demangle.h.