diff --git a/libiberty/ChangeLog b/libiberty/ChangeLog
index 2522b8270e6..eb19aa71e4c 100644
--- a/libiberty/ChangeLog
+++ b/libiberty/ChangeLog
@@ -1,3 +1,10 @@
+2005-07-01  Ian Lance Taylor  <ian@airs.com>
+
+	PR other/22268
+	* cp-demangle.c (d_expr_primary): Don't run off the end of the
+	string while looking for the end of a literal value.
+	* testsuite/demangle-expected: Add test case.
+
 2005-06-30  Daniel Berlin  <dberlin@dberlin.org>
 
 	* hashtab.c (EMPTY_ENTRY): Moved and renamed.
diff --git a/libiberty/cp-demangle.c b/libiberty/cp-demangle.c
index 61744390725..8f1cfb17f87 100644
--- a/libiberty/cp-demangle.c
+++ b/libiberty/cp-demangle.c
@@ -2337,7 +2337,11 @@ d_expr_primary (struct d_info *di)
 	}
       s = d_str (di);
       while (d_peek_char (di) != 'E')
-	d_advance (di, 1);
+	{
+	  if (d_peek_char (di) == '\0')
+	    return NULL;
+	  d_advance (di, 1);
+	}
       ret = d_make_comp (di, t, type, d_make_name (di, s, d_str (di) - s));
     }
   if (d_next_char (di) != 'E')
diff --git a/libiberty/testsuite/demangle-expected b/libiberty/testsuite/demangle-expected
index f8e402d01bd..4526773a780 100644
--- a/libiberty/testsuite/demangle-expected
+++ b/libiberty/testsuite/demangle-expected
@@ -3704,6 +3704,12 @@ foo<int (*) [3]>
 _ZN13PatternDriver23StringScalarDeleteValueC1ERKNS_25ConflateStringScalarValueERKNS_25AbstractStringScalarValueERKNS_12TemplateEnumINS_12pdcomplementELZNS_16complement_namesEELZNS_14COMPLEMENTENUMEEEE
 _ZN13PatternDriver23StringScalarDeleteValueC1ERKNS_25ConflateStringScalarValueERKNS_25AbstractStringScalarValueERKNS_12TemplateEnumINS_12pdcomplementELZNS_16complement_namesEELZNS_14COMPLEMENTENUMEEEE
 PatternDriver::StringScalarDeleteValue::StringScalarDeleteValue
+#
+# This used to cause the demangler to walk into undefined memory--PR 22268
+--format=gnu-v3 --no-params
+ALsetchannels
+ALsetchannels
+ALsetchannels
 # Test GNU V3 constructor and destructor identification.
 # 0 means it is not a constructor/destructor.
 # Other integers correspond to enum gnu_v3_{c,d}tor_kinds in demangle.h.