OpenE2K/gcc
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix a stack exhaustion bug in libiberty's demangler when decoding a pathalogically constructed mangled name.

Browse Source 
PR 89394
	* cp-demangle.c (cplus_demangle_fill_name): Reject negative
	lengths.
	(d_count_templates_scopes): Replace num_templates and num_scopes
	parameters with a struct d_print_info pointer parameter.  Adjust
	body of the function accordingly.  Add recursion counter and check
	that the recursion limit is not reached.
	(d_print_init): Pass dpi parameter to d_count_templates_scopes.
	Reset recursion counter afterwards, unless the recursion limit was
	reached.

From-SVN: r270258
This commit is contained in:
Nick Clifton 2019-04-10 14:44:47 +00:00 committed by Nick Clifton
parent 07c2fa4665
commit 6fe6bd7c08
2 changed files with 39 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
libiberty/ChangeLog
View File

@ -1,3 +1,16 @@
2019-04-10 Nick Clifton <nickc@redhat.com>
PR 89394
* cp-demangle.c (cplus_demangle_fill_name): Reject negative
lengths.
(d_count_templates_scopes): Replace num_templates and num_scopes
parameters with a struct d_print_info pointer parameter. Adjust
body of the function accordingly. Add recursion counter and check
that the recursion limit is not reached.
(d_print_init): Pass dpi parameter to d_count_templates_scopes.
Reset recursion counter afterwards, unless the recursion limit was
reached.
2019-04-07 Alan Modra <amodra@gmail.com>
* functions.texi: Regenerate.

48
libiberty/cp-demangle.c
View File

@ -861,7 +861,7 @@ CP_STATIC_IF_GLIBCPP_V3
int
cplus_demangle_fill_name (struct demangle_component *p, const char *s, int len)
{
if (p == NULL || s == NULL || len == 0)
if (p == NULL || s == NULL || len <= 0)
return 0;
p->d_printing = 0;
p->type = DEMANGLE_COMPONENT_NAME;
@ -4061,7 +4061,7 @@ d_growable_string_callback_adapter (const char *s, size_t l, void *opaque)
are larger than the actual numbers encountered. */
static void
d_count_templates_scopes (int *num_templates, int *num_scopes,
d_count_templates_scopes (struct d_print_info *dpi,
const struct demangle_component *dc)
{
if (dc == NULL)
@ -4081,13 +4081,13 @@ d_count_templates_scopes (int *num_templates, int *num_scopes,
break;
case DEMANGLE_COMPONENT_TEMPLATE:
(*num_templates)++;
dpi->num_copy_templates++;
goto recurse_left_right;
case DEMANGLE_COMPONENT_REFERENCE:
case DEMANGLE_COMPONENT_RVALUE_REFERENCE:
if (d_left (dc)->type == DEMANGLE_COMPONENT_TEMPLATE_PARAM)
(*num_scopes)++;
dpi->num_saved_scopes++;
goto recurse_left_right;
case DEMANGLE_COMPONENT_QUAL_NAME:
@ -4152,42 +4152,42 @@ d_count_templates_scopes (int *num_templates, int *num_scopes,
case DEMANGLE_COMPONENT_TAGGED_NAME:
case DEMANGLE_COMPONENT_CLONE:
recurse_left_right:
d_count_templates_scopes (num_templates, num_scopes,
d_left (dc));
d_count_templates_scopes (num_templates, num_scopes,
d_right (dc));
/* PR 89394 - Check for too much recursion. */
if (dpi->recursion > DEMANGLE_RECURSION_LIMIT)
/* FIXME: There ought to be a way to report to the
user that the recursion limit has been reached. */
return;
++ dpi->recursion;
d_count_templates_scopes (dpi, d_left (dc));
d_count_templates_scopes (dpi, d_right (dc));
-- dpi->recursion;
break;
case DEMANGLE_COMPONENT_CTOR:
d_count_templates_scopes (num_templates, num_scopes,
dc->u.s_ctor.name);
d_count_templates_scopes (dpi, dc->u.s_ctor.name);
break;
case DEMANGLE_COMPONENT_DTOR:
d_count_templates_scopes (num_templates, num_scopes,
dc->u.s_dtor.name);
d_count_templates_scopes (dpi, dc->u.s_dtor.name);
break;
case DEMANGLE_COMPONENT_EXTENDED_OPERATOR:
d_count_templates_scopes (num_templates, num_scopes,
dc->u.s_extended_operator.name);
d_count_templates_scopes (dpi, dc->u.s_extended_operator.name);
break;
case DEMANGLE_COMPONENT_FIXED_TYPE:
d_count_templates_scopes (num_templates, num_scopes,
dc->u.s_fixed.length);
d_count_templates_scopes (dpi, dc->u.s_fixed.length);
break;
case DEMANGLE_COMPONENT_GLOBAL_CONSTRUCTORS:
case DEMANGLE_COMPONENT_GLOBAL_DESTRUCTORS:
d_count_templates_scopes (num_templates, num_scopes,
d_left (dc));
d_count_templates_scopes (dpi, d_left (dc));
break;
case DEMANGLE_COMPONENT_LAMBDA:
case DEMANGLE_COMPONENT_DEFAULT_ARG:
d_count_templates_scopes (num_templates, num_scopes,
dc->u.s_unary_num.sub);
d_count_templates_scopes (dpi, dc->u.s_unary_num.sub);
break;
}
}
@ -4222,8 +4222,12 @@ d_print_init (struct d_print_info *dpi, demangle_callbackref callback,
dpi->next_copy_template = 0;
dpi->num_copy_templates = 0;
d_count_templates_scopes (&dpi->num_copy_templates,
&dpi->num_saved_scopes, dc);
d_count_templates_scopes (dpi, dc);
/* If we did not reach the recursion limit, then reset the
current recursion value back to 0, so that we can print
the templates. */
if (dpi->recursion < DEMANGLE_RECURSION_LIMIT)
dpi->recursion = 0;
dpi->num_copy_templates *= dpi->num_saved_scopes;
dpi->current_template = NULL;