aboutsummaryrefslogtreecommitdiff
path: root/libiberty
diff options
context:
space:
mode:
Diffstat (limited to 'libiberty')
-rw-r--r--libiberty/ChangeLog27
-rw-r--r--libiberty/cp-demangle.c57
-rw-r--r--libiberty/cp-demangle.h8
-rw-r--r--libiberty/testsuite/demangle-expected22
-rw-r--r--libiberty/testsuite/test-demangle.c56
5 files changed, 136 insertions, 34 deletions
diff --git a/libiberty/ChangeLog b/libiberty/ChangeLog
index 4b27eb0..e72f845 100644
--- a/libiberty/ChangeLog
+++ b/libiberty/ChangeLog
@@ -1,3 +1,30 @@
+2006-12-20 Geoffrey Keating <geoffk@apple.com>
+
+ * cp-demangle.h: Add comment explaining what to do to avoid
+ overrunning string.
+ (d_check_char): New.
+ (d_next_char): Don't advance past trailing '\0'.
+ * cp-demangle.c (cplus_demangle_mangled_name): Use d_check_char.
+ (d_nested_name): Likewise.
+ (d_special_name): Likewise.
+ (d_call_offset): Likewise.
+ (d_function_type): Likewise.
+ (d_array_type): Likewise.
+ (d_pointer_to_member_type): Likewise.
+ (d_template_param): Likewise.
+ (d_template_args): Likewise.
+ (d_template_arg): Likewise.
+ (d_expr_primary): Likewise.
+ (d_local_name): Likewise.
+ (d_substitution): Likewise.
+ (d_ctor_dtor_name): Use d_advance rather than d_next_char.
+ * testsuite/test-demangle.c: Include sys/mman.h.
+ (MAP_ANONYMOUS): Define.
+ (protect_end): New.
+ (main): Use protect_end.
+ * testsuite/demangle-expected: Add testcases for overrunning
+ the end of the string.
+
2006-11-30 Andrew Stubbs <andrew.stubbs@st.com>
J"orn Rennecke <joern.rennecke@st.com>
diff --git a/libiberty/cp-demangle.c b/libiberty/cp-demangle.c
index 2fa5978..ac1dfe5 100644
--- a/libiberty/cp-demangle.c
+++ b/libiberty/cp-demangle.c
@@ -913,9 +913,9 @@ CP_STATIC_IF_GLIBCPP_V3
struct demangle_component *
cplus_demangle_mangled_name (struct d_info *di, int top_level)
{
- if (d_next_char (di) != '_')
+ if (! d_check_char (di, '_'))
return NULL;
- if (d_next_char (di) != 'Z')
+ if (! d_check_char (di, 'Z'))
return NULL;
return d_encoding (di, top_level);
}
@@ -1123,7 +1123,7 @@ d_nested_name (struct d_info *di)
struct demangle_component *ret;
struct demangle_component **pret;
- if (d_next_char (di) != 'N')
+ if (! d_check_char (di, 'N'))
return NULL;
pret = d_cv_qualifiers (di, &ret, 1);
@@ -1134,7 +1134,7 @@ d_nested_name (struct d_info *di)
if (*pret == NULL)
return NULL;
- if (d_next_char (di) != 'E')
+ if (! d_check_char (di, 'E'))
return NULL;
return ret;
@@ -1449,11 +1449,8 @@ d_operator_name (struct d_info *di)
static struct demangle_component *
d_special_name (struct d_info *di)
{
- char c;
-
di->expansion += 20;
- c = d_next_char (di);
- if (c == 'T')
+ if (d_check_char (di, 'T'))
{
switch (d_next_char (di))
{
@@ -1502,7 +1499,7 @@ d_special_name (struct d_info *di)
offset = d_number (di);
if (offset < 0)
return NULL;
- if (d_next_char (di) != '_')
+ if (! d_check_char (di, '_'))
return NULL;
base_type = cplus_demangle_type (di);
/* We don't display the offset. FIXME: We should display
@@ -1523,7 +1520,7 @@ d_special_name (struct d_info *di)
return NULL;
}
}
- else if (c == 'G')
+ else if (d_check_char (di, 'G'))
{
switch (d_next_char (di))
{
@@ -1570,14 +1567,14 @@ d_call_offset (struct d_info *di, int c)
else if (c == 'v')
{
d_number (di);
- if (d_next_char (di) != '_')
+ if (! d_check_char (di, '_'))
return 0;
d_number (di);
}
else
return 0;
- if (d_next_char (di) != '_')
+ if (! d_check_char (di, '_'))
return 0;
return 1;
@@ -1601,13 +1598,13 @@ d_ctor_dtor_name (struct d_info *di)
else if (di->last_name->type == DEMANGLE_COMPONENT_SUB_STD)
di->expansion += di->last_name->u.s_string.len;
}
- switch (d_next_char (di))
+ switch (d_peek_char (di))
{
case 'C':
{
enum gnu_v3_ctor_kinds kind;
- switch (d_next_char (di))
+ switch (d_peek_next_char (di))
{
case '1':
kind = gnu_v3_complete_object_ctor;
@@ -1621,6 +1618,7 @@ d_ctor_dtor_name (struct d_info *di)
default:
return NULL;
}
+ d_advance (di, 2);
return d_make_ctor (di, kind, di->last_name);
}
@@ -1628,7 +1626,7 @@ d_ctor_dtor_name (struct d_info *di)
{
enum gnu_v3_dtor_kinds kind;
- switch (d_next_char (di))
+ switch (d_peek_next_char (di))
{
case '0':
kind = gnu_v3_deleting_dtor;
@@ -1642,6 +1640,7 @@ d_ctor_dtor_name (struct d_info *di)
default:
return NULL;
}
+ d_advance (di, 2);
return d_make_dtor (di, kind, di->last_name);
}
@@ -1925,7 +1924,7 @@ d_function_type (struct d_info *di)
{
struct demangle_component *ret;
- if (d_next_char (di) != 'F')
+ if (! d_check_char (di, 'F'))
return NULL;
if (d_peek_char (di) == 'Y')
{
@@ -1934,7 +1933,7 @@ d_function_type (struct d_info *di)
d_advance (di, 1);
}
ret = d_bare_function_type (di, 1);
- if (d_next_char (di) != 'E')
+ if (! d_check_char (di, 'E'))
return NULL;
return ret;
}
@@ -2021,7 +2020,7 @@ d_array_type (struct d_info *di)
char peek;
struct demangle_component *dim;
- if (d_next_char (di) != 'A')
+ if (! d_check_char (di, 'A'))
return NULL;
peek = d_peek_char (di);
@@ -2049,7 +2048,7 @@ d_array_type (struct d_info *di)
return NULL;
}
- if (d_next_char (di) != '_')
+ if (! d_check_char (di, '_'))
return NULL;
return d_make_comp (di, DEMANGLE_COMPONENT_ARRAY_TYPE, dim,
@@ -2065,7 +2064,7 @@ d_pointer_to_member_type (struct d_info *di)
struct demangle_component *mem;
struct demangle_component **pmem;
- if (d_next_char (di) != 'M')
+ if (! d_check_char (di, 'M'))
return NULL;
cl = cplus_demangle_type (di);
@@ -2109,7 +2108,7 @@ d_template_param (struct d_info *di)
{
long param;
- if (d_next_char (di) != 'T')
+ if (! d_check_char (di, 'T'))
return NULL;
if (d_peek_char (di) == '_')
@@ -2122,7 +2121,7 @@ d_template_param (struct d_info *di)
param += 1;
}
- if (d_next_char (di) != '_')
+ if (! d_check_char (di, '_'))
return NULL;
++di->did_subs;
@@ -2144,7 +2143,7 @@ d_template_args (struct d_info *di)
constructor or destructor. */
hold_last_name = di->last_name;
- if (d_next_char (di) != 'I')
+ if (! d_check_char (di, 'I'))
return NULL;
al = NULL;
@@ -2189,7 +2188,7 @@ d_template_arg (struct d_info *di)
case 'X':
d_advance (di, 1);
ret = d_expression (di);
- if (d_next_char (di) != 'E')
+ if (! d_check_char (di, 'E'))
return NULL;
return ret;
@@ -2316,7 +2315,7 @@ d_expr_primary (struct d_info *di)
{
struct demangle_component *ret;
- if (d_next_char (di) != 'L')
+ if (! d_check_char (di, 'L'))
return NULL;
if (d_peek_char (di) == '_')
ret = cplus_demangle_mangled_name (di, 0);
@@ -2362,7 +2361,7 @@ d_expr_primary (struct d_info *di)
}
ret = d_make_comp (di, t, type, d_make_name (di, s, d_str (di) - s));
}
- if (d_next_char (di) != 'E')
+ if (! d_check_char (di, 'E'))
return NULL;
return ret;
}
@@ -2376,12 +2375,12 @@ d_local_name (struct d_info *di)
{
struct demangle_component *function;
- if (d_next_char (di) != 'Z')
+ if (! d_check_char (di, 'Z'))
return NULL;
function = d_encoding (di, 0);
- if (d_next_char (di) != 'E')
+ if (! d_check_char (di, 'E'))
return NULL;
if (d_peek_char (di) == 's')
@@ -2486,7 +2485,7 @@ d_substitution (struct d_info *di, int prefix)
{
char c;
- if (d_next_char (di) != 'S')
+ if (! d_check_char (di, 'S'))
return NULL;
c = d_next_char (di);
diff --git a/libiberty/cp-demangle.h b/libiberty/cp-demangle.h
index 2517a57e..920ca47 100644
--- a/libiberty/cp-demangle.h
+++ b/libiberty/cp-demangle.h
@@ -123,10 +123,16 @@ struct d_info
int expansion;
};
+/* To avoid running past the ending '\0', don't:
+ - call d_peek_next_char if d_peek_char returned '\0'
+ - call d_advance with an 'i' that is too large
+ - call d_check_char(di, '\0')
+ Everything else is safe. */
#define d_peek_char(di) (*((di)->n))
#define d_peek_next_char(di) ((di)->n[1])
#define d_advance(di, i) ((di)->n += (i))
-#define d_next_char(di) (*((di)->n++))
+#define d_check_char(di, c) (d_peek_char(di) == c ? ((di)->n++, 1) : 0)
+#define d_next_char(di) (d_peek_char(di) == '\0' ? '\0' : *((di)->n++))
#define d_str(di) ((di)->n)
/* Functions and arrays in cp-demangle.c which are referenced by
diff --git a/libiberty/testsuite/demangle-expected b/libiberty/testsuite/demangle-expected
index 3f5622f..56d9f89 100644
--- a/libiberty/testsuite/demangle-expected
+++ b/libiberty/testsuite/demangle-expected
@@ -3816,3 +3816,25 @@ f
SASDASDFASDF_sdfsdf
SASDASDFASDF_sdfsdf
SASDASDFASDF_sdfsdf
+# These are all cases of invalid manglings where the demangler would read
+# past the end of the string.
+# d_name wasn't honouring a NULL from d_substitution
+--format=gnu-v3
+_ZSA
+_ZSA
+# d_expr_primary wasn't honouring NULL from cplus_demangle_mangled_name
+--format=gnu-v3
+_ZN1fIL_
+_ZN1fIL_
+# d_operator_name was taking two characters in a row
+--format=gnu-v3
+_Za
+_Za
+# d_prefix wasn't honouring NULL from d_substitution
+--format=gnu-v3
+_ZNSA
+_ZNSA
+# d_prefix wasn't honouring NULL from d_template_param
+--format=gnu-v3
+_ZNT
+_ZNT
diff --git a/libiberty/testsuite/test-demangle.c b/libiberty/testsuite/test-demangle.c
index 9379399..12b07dd 100644
--- a/libiberty/testsuite/test-demangle.c
+++ b/libiberty/testsuite/test-demangle.c
@@ -86,6 +86,50 @@ getline(buf)
buf->alloced = alloc;
}
+/* If we have mmap() and mprotect(), copy the string S just before a
+ protected page, so that if the demangler runs over the end of the
+ string we'll get a fault, and return the address of the new string.
+ If no mmap, or it fails, or it looks too hard, just return S. */
+
+#ifdef HAVE_SYS_MMAN_H
+#include <sys/mman.h>
+#endif
+#if defined(MAP_ANON) && ! defined (MAP_ANONYMOUS)
+#define MAP_ANONYMOUS MAP_ANON
+#endif
+
+static const char *
+protect_end (const char * s)
+{
+#if defined(HAVE_MMAP) && defined (MAP_ANONYMOUS)
+ size_t pagesize = getpagesize();
+ static char * buf;
+ size_t s_len = strlen (s);
+ char * result;
+
+ /* Don't try if S is too long. */
+ if (s_len >= pagesize)
+ return s;
+
+ /* Allocate one page of allocated space followed by an unmapped
+ page. */
+ if (buf == NULL)
+ {
+ buf = mmap (NULL, pagesize * 2, PROT_READ | PROT_WRITE,
+ MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+ if (! buf)
+ return s;
+ munmap (buf + pagesize, pagesize);
+ }
+
+ result = buf + (pagesize - s_len - 1);
+ memcpy (result, s, s_len + 1);
+ return result;
+#else
+ return s;
+#endif
+}
+
static void
fail (lineno, opts, in, out, exp)
int lineno;
@@ -150,6 +194,8 @@ main(argc, argv)
for (;;)
{
+ const char *inp;
+
getline (&format);
if (feof (stdin))
break;
@@ -157,6 +203,8 @@ main(argc, argv)
getline (&input);
getline (&expect);
+ inp = protect_end (input.data);
+
tests++;
no_params = 0;
@@ -237,14 +285,14 @@ main(argc, argv)
{
enum gnu_v3_ctor_kinds kc;
- kc = is_gnu_v3_mangled_ctor (input.data);
+ kc = is_gnu_v3_mangled_ctor (inp);
sprintf (buf, "%d", (int) kc);
}
else
{
enum gnu_v3_dtor_kinds kd;
- kd = is_gnu_v3_mangled_dtor (input.data);
+ kd = is_gnu_v3_mangled_dtor (inp);
sprintf (buf, "%d", (int) kd);
}
@@ -259,7 +307,7 @@ main(argc, argv)
cplus_demangle_set_style (style);
- result = cplus_demangle (input.data,
+ result = cplus_demangle (inp,
DMGL_PARAMS|DMGL_ANSI|DMGL_TYPES
|(ret_postfix ? DMGL_RET_POSTFIX : 0));
@@ -275,7 +323,7 @@ main(argc, argv)
if (no_params)
{
getline (&expect);
- result = cplus_demangle (input.data, DMGL_ANSI|DMGL_TYPES);
+ result = cplus_demangle (inp, DMGL_ANSI|DMGL_TYPES);
if (result
? strcmp (result, expect.data)