Demangler integer overflow fixes from Marcel Böhme.
PR c++/70498 * cp-demangle.c: Parse numbers as integer instead of long to avoid overflow after sanity checks. Include <limits.h> if available. (INT_MAX): Define if necessary. (d_make_template_param): Takes integer argument instead of long. (d_make_function_param): Likewise. (d_append_num): Likewise. (d_identifier): Likewise. (d_number): Parse as and return integer. (d_compact_number): Handle overflow. (d_source_name): Change variable type to integer for parsed number. (d_java_resource): Likewise. (d_special_name): Likewise. (d_discriminator): Likewise. (d_unnamed_type): Likewise. * testsuite/demangle-expected: Add regression test cases. From-SVN: r235767
This commit is contained in:
Marcel Böhme
Bernd Schmidt
parent
818b88a7a1
commit
bfbc839a0b
|
|
@ -1,3 +1,22 @@
|
|||
2016-05-02 Marcel Böhme <boehme.marcel@gmail.com>
|
||||
|
||||
PR c++/70498
|
||||
* cp-demangle.c: Parse numbers as integer instead of long to avoid
|
||||
overflow after sanity checks. Include <limits.h> if available.
|
||||
(INT_MAX): Define if necessary.
|
||||
(d_make_template_param): Takes integer argument instead of long.
|
||||
(d_make_function_param): Likewise.
|
||||
(d_append_num): Likewise.
|
||||
(d_identifier): Likewise.
|
||||
(d_number): Parse as and return integer.
|
||||
(d_compact_number): Handle overflow.
|
||||
(d_source_name): Change variable type to integer for parsed number.
|
||||
(d_java_resource): Likewise.
|
||||
(d_special_name): Likewise.
|
||||
(d_discriminator): Likewise.
|
||||
(d_unnamed_type): Likewise.
|
||||
* testsuite/demangle-expected: Add regression test cases.
|
||||
|
||||
2016-04-30 Oleg Endo <olegendo@gcc.gnu.org>
|
||||
|
||||
* configure: Remove SH5 support.
|
||||
|
|
|
|||
|
|
@ -128,6 +128,13 @@ extern char *alloca ();
|
|||
# endif /* alloca */
|
||||
#endif /* HAVE_ALLOCA_H */
|
||||
|
||||
#ifdef HAVE_LIMITS_H
|
||||
#include <limits.h>
|
||||
#endif
|
||||
#ifndef INT_MAX
|
||||
# define INT_MAX (int)(((unsigned int) ~0) >> 1) /* 0x7FFFFFFF */
|
||||
#endif
|
||||
|
||||
#include "ansidecl.h"
|
||||
#include "libiberty.h"
|
||||
#include "demangle.h"
|
||||
|
|
@ -398,7 +405,7 @@ d_make_dtor (struct d_info *, enum gnu_v3_dtor_kinds,
|
|||
struct demangle_component *);
|
||||
|
||||
static struct demangle_component *
|
||||
d_make_template_param (struct d_info *, long);
|
||||
d_make_template_param (struct d_info *, int);
|
||||
|
||||
static struct demangle_component *
|
||||
d_make_sub (struct d_info *, const char *, int);
|
||||
|
|
@ -421,9 +428,9 @@ static struct demangle_component *d_unqualified_name (struct d_info *);
|
|||
|
||||
static struct demangle_component *d_source_name (struct d_info *);
|
||||
|
||||
static long d_number (struct d_info *);
|
||||
static int d_number (struct d_info *);
|
||||
|
||||
static struct demangle_component *d_identifier (struct d_info *, long);
|
||||
static struct demangle_component *d_identifier (struct d_info *, int);
|
||||
|
||||
static struct demangle_component *d_operator_name (struct d_info *);
|
||||
|
||||
|
|
@ -1119,7 +1126,7 @@ d_make_dtor (struct d_info *di, enum gnu_v3_dtor_kinds kind,
|
|||
/* Add a new template parameter. */
|
||||
|
||||
static struct demangle_component *
|
||||
d_make_template_param (struct d_info *di, long i)
|
||||
d_make_template_param (struct d_info *di, int i)
|
||||
{
|
||||
struct demangle_component *p;
|
||||
|
||||
|
|
@ -1135,7 +1142,7 @@ d_make_template_param (struct d_info *di, long i)
|
|||
/* Add a new function parameter. */
|
||||
|
||||
static struct demangle_component *
|
||||
d_make_function_param (struct d_info *di, long i)
|
||||
d_make_function_param (struct d_info *di, int i)
|
||||
{
|
||||
struct demangle_component *p;
|
||||
|
||||
|
|
@ -1620,7 +1627,7 @@ d_unqualified_name (struct d_info *di)
|
|||
static struct demangle_component *
|
||||
d_source_name (struct d_info *di)
|
||||
{
|
||||
long len;
|
||||
int len;
|
||||
struct demangle_component *ret;
|
||||
|
||||
len = d_number (di);
|
||||
|
|
@ -1633,12 +1640,12 @@ d_source_name (struct d_info *di)
|
|||
|
||||
/* number ::= [n] <(non-negative decimal integer)> */
|
||||
|
||||
static long
|
||||
static int
|
||||
d_number (struct d_info *di)
|
||||
{
|
||||
int negative;
|
||||
char peek;
|
||||
long ret;
|
||||
int ret;
|
||||
|
||||
negative = 0;
|
||||
peek = d_peek_char (di);
|
||||
|
|
@ -1681,7 +1688,7 @@ d_number_component (struct d_info *di)
|
|||
/* identifier ::= <(unqualified source code identifier)> */
|
||||
|
||||
static struct demangle_component *
|
||||
d_identifier (struct d_info *di, long len)
|
||||
d_identifier (struct d_info *di, int len)
|
||||
{
|
||||
const char *name;
|
||||
|
||||
|
|
@ -1702,7 +1709,7 @@ d_identifier (struct d_info *di, long len)
|
|||
/* Look for something which looks like a gcc encoding of an
|
||||
anonymous namespace, and replace it with a more user friendly
|
||||
name. */
|
||||
if (len >= (long) ANONYMOUS_NAMESPACE_PREFIX_LEN + 2
|
||||
if (len >= (int) ANONYMOUS_NAMESPACE_PREFIX_LEN + 2
|
||||
&& memcmp (name, ANONYMOUS_NAMESPACE_PREFIX,
|
||||
ANONYMOUS_NAMESPACE_PREFIX_LEN) == 0)
|
||||
{
|
||||
|
|
@ -1870,7 +1877,7 @@ d_java_resource (struct d_info *di)
|
|||
{
|
||||
struct demangle_component *p = NULL;
|
||||
struct demangle_component *next = NULL;
|
||||
long len, i;
|
||||
int len, i;
|
||||
char c;
|
||||
const char *str;
|
||||
|
||||
|
|
@ -2012,7 +2019,7 @@ d_special_name (struct d_info *di)
|
|||
case 'C':
|
||||
{
|
||||
struct demangle_component *derived_type;
|
||||
long offset;
|
||||
int offset;
|
||||
struct demangle_component *base_type;
|
||||
|
||||
derived_type = cplus_demangle_type (di);
|
||||
|
|
@ -2946,10 +2953,10 @@ d_pointer_to_member_type (struct d_info *di)
|
|||
|
||||
/* <non-negative number> _ */
|
||||
|
||||
static long
|
||||
static int
|
||||
d_compact_number (struct d_info *di)
|
||||
{
|
||||
long num;
|
||||
int num;
|
||||
if (d_peek_char (di) == '_')
|
||||
num = 0;
|
||||
else if (d_peek_char (di) == 'n')
|
||||
|
|
@ -2957,7 +2964,7 @@ d_compact_number (struct d_info *di)
|
|||
else
|
||||
num = d_number (di) + 1;
|
||||
|
||||
if (! d_check_char (di, '_'))
|
||||
if (num < 0 || ! d_check_char (di, '_'))
|
||||
return -1;
|
||||
return num;
|
||||
}
|
||||
|
|
@ -2969,7 +2976,7 @@ d_compact_number (struct d_info *di)
|
|||
static struct demangle_component *
|
||||
d_template_param (struct d_info *di)
|
||||
{
|
||||
long param;
|
||||
int param;
|
||||
|
||||
if (! d_check_char (di, 'T'))
|
||||
return NULL;
|
||||
|
|
@ -3171,9 +3178,10 @@ d_expression_1 (struct d_info *di)
|
|||
}
|
||||
else
|
||||
{
|
||||
index = d_compact_number (di) + 1;
|
||||
if (index == 0)
|
||||
index = d_compact_number (di);
|
||||
if (index == INT_MAX || index == -1)
|
||||
return NULL;
|
||||
index ++;
|
||||
}
|
||||
return d_make_function_param (di, index);
|
||||
}
|
||||
|
|
@ -3502,7 +3510,7 @@ d_local_name (struct d_info *di)
|
|||
static int
|
||||
d_discriminator (struct d_info *di)
|
||||
{
|
||||
long discrim;
|
||||
int discrim;
|
||||
|
||||
if (d_peek_char (di) != '_')
|
||||
return 1;
|
||||
|
|
@ -3558,7 +3566,7 @@ static struct demangle_component *
|
|||
d_unnamed_type (struct d_info *di)
|
||||
{
|
||||
struct demangle_component *ret;
|
||||
long num;
|
||||
int num;
|
||||
|
||||
if (! d_check_char (di, 'U'))
|
||||
return NULL;
|
||||
|
|
@ -4086,10 +4094,10 @@ d_append_string (struct d_print_info *dpi, const char *s)
|
|||
}
|
||||
|
||||
static inline void
|
||||
d_append_num (struct d_print_info *dpi, long l)
|
||||
d_append_num (struct d_print_info *dpi, int l)
|
||||
{
|
||||
char buf[25];
|
||||
sprintf (buf,"%ld", l);
|
||||
sprintf (buf,"%d", l);
|
||||
d_append_string (dpi, buf);
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -4422,12 +4422,22 @@ void baz<int>(A<sizeof (foo((int)(), (floatcomplex )00000000_00000000))>*)
|
|||
_Z3fooI1FEN1XIXszdtcl1PclcvT__EEE5arrayEE4TypeEv
|
||||
X<sizeof ((P(((F)())())).array)>::Type foo<F>()
|
||||
#
|
||||
# Tests a use-after-free problem
|
||||
# Tests a use-after-free problem PR70481
|
||||
|
||||
_Q.__0
|
||||
::Q.(void)
|
||||
#
|
||||
# Tests a use-after-free problem
|
||||
# Tests a use-after-free problem PR70481
|
||||
|
||||
_Q10-__9cafebabe.
|
||||
cafebabe.::-(void)
|
||||
#
|
||||
# Tests integer overflow problem PR70492
|
||||
|
||||
__vt_90000000000cafebabe
|
||||
__vt_90000000000cafebabe
|
||||
#
|
||||
# Tests write access violation PR70498
|
||||
|
||||
_Z80800000000000000000000
|
||||
_Z80800000000000000000000
|
||||
|
|
|
|||
Loading…
Reference in New Issue