aboutsummaryrefslogtreecommitdiff
path: root/libiberty
diff options
context:
space:
mode:
authorNick Clifton <nickc@redhat.com>2019-04-10 15:49:36 +0100
committerNick Clifton <nickc@redhat.com>2019-04-10 15:49:36 +0100
commitc1202057eb9161a86af27d867703235fee7b7555 (patch)
treec2e598f711cb9142e77d3c2d241cba0a2ff05601 /libiberty
parente9ad22ee5f0a40dfa1182ee68e3349dd72a42afe (diff)
downloadgdb-c1202057eb9161a86af27d867703235fee7b7555.zip
gdb-c1202057eb9161a86af27d867703235fee7b7555.tar.gz
gdb-c1202057eb9161a86af27d867703235fee7b7555.tar.bz2
Pull in patch for libiberty that fixes a stack exhaustion bug when demangling a pathalogically constructed mangled name.
PR 89394 * cp-demangle.c (cplus_demangle_fill_name): Reject negative lengths. (d_count_templates_scopes): Replace num_templates and num_scopes parameters with a struct d_print_info pointer parameter. Adjust body of the function accordingly. Add recursion counter and check that the recursion limit is not reached. (d_print_init): Pass dpi parameter to d_count_templates_scopes. Reset recursion counter afterwards, unless the recursion limit was reached.
Diffstat (limited to 'libiberty')
-rw-r--r--libiberty/cp-demangle.c48
1 files changed, 26 insertions, 22 deletions
diff --git a/libiberty/cp-demangle.c b/libiberty/cp-demangle.c
index b34b485..779b4e7 100644
--- a/libiberty/cp-demangle.c
+++ b/libiberty/cp-demangle.c
@@ -861,7 +861,7 @@ CP_STATIC_IF_GLIBCPP_V3
int
cplus_demangle_fill_name (struct demangle_component *p, const char *s, int len)
{
- if (p == NULL || s == NULL || len == 0)
+ if (p == NULL || s == NULL || len <= 0)
return 0;
p->d_printing = 0;
p->type = DEMANGLE_COMPONENT_NAME;
@@ -4061,7 +4061,7 @@ d_growable_string_callback_adapter (const char *s, size_t l, void *opaque)
are larger than the actual numbers encountered. */
static void
-d_count_templates_scopes (int *num_templates, int *num_scopes,
+d_count_templates_scopes (struct d_print_info *dpi,
const struct demangle_component *dc)
{
if (dc == NULL)
@@ -4081,13 +4081,13 @@ d_count_templates_scopes (int *num_templates, int *num_scopes,
break;
case DEMANGLE_COMPONENT_TEMPLATE:
- (*num_templates)++;
+ dpi->num_copy_templates++;
goto recurse_left_right;
case DEMANGLE_COMPONENT_REFERENCE:
case DEMANGLE_COMPONENT_RVALUE_REFERENCE:
if (d_left (dc)->type == DEMANGLE_COMPONENT_TEMPLATE_PARAM)
- (*num_scopes)++;
+ dpi->num_saved_scopes++;
goto recurse_left_right;
case DEMANGLE_COMPONENT_QUAL_NAME:
@@ -4152,42 +4152,42 @@ d_count_templates_scopes (int *num_templates, int *num_scopes,
case DEMANGLE_COMPONENT_TAGGED_NAME:
case DEMANGLE_COMPONENT_CLONE:
recurse_left_right:
- d_count_templates_scopes (num_templates, num_scopes,
- d_left (dc));
- d_count_templates_scopes (num_templates, num_scopes,
- d_right (dc));
+ /* PR 89394 - Check for too much recursion. */
+ if (dpi->recursion > DEMANGLE_RECURSION_LIMIT)
+ /* FIXME: There ought to be a way to report to the
+ user that the recursion limit has been reached. */
+ return;
+
+ ++ dpi->recursion;
+ d_count_templates_scopes (dpi, d_left (dc));
+ d_count_templates_scopes (dpi, d_right (dc));
+ -- dpi->recursion;
break;
case DEMANGLE_COMPONENT_CTOR:
- d_count_templates_scopes (num_templates, num_scopes,
- dc->u.s_ctor.name);
+ d_count_templates_scopes (dpi, dc->u.s_ctor.name);
break;
case DEMANGLE_COMPONENT_DTOR:
- d_count_templates_scopes (num_templates, num_scopes,
- dc->u.s_dtor.name);
+ d_count_templates_scopes (dpi, dc->u.s_dtor.name);
break;
case DEMANGLE_COMPONENT_EXTENDED_OPERATOR:
- d_count_templates_scopes (num_templates, num_scopes,
- dc->u.s_extended_operator.name);
+ d_count_templates_scopes (dpi, dc->u.s_extended_operator.name);
break;
case DEMANGLE_COMPONENT_FIXED_TYPE:
- d_count_templates_scopes (num_templates, num_scopes,
- dc->u.s_fixed.length);
+ d_count_templates_scopes (dpi, dc->u.s_fixed.length);
break;
case DEMANGLE_COMPONENT_GLOBAL_CONSTRUCTORS:
case DEMANGLE_COMPONENT_GLOBAL_DESTRUCTORS:
- d_count_templates_scopes (num_templates, num_scopes,
- d_left (dc));
+ d_count_templates_scopes (dpi, d_left (dc));
break;
case DEMANGLE_COMPONENT_LAMBDA:
case DEMANGLE_COMPONENT_DEFAULT_ARG:
- d_count_templates_scopes (num_templates, num_scopes,
- dc->u.s_unary_num.sub);
+ d_count_templates_scopes (dpi, dc->u.s_unary_num.sub);
break;
}
}
@@ -4222,8 +4222,12 @@ d_print_init (struct d_print_info *dpi, demangle_callbackref callback,
dpi->next_copy_template = 0;
dpi->num_copy_templates = 0;
- d_count_templates_scopes (&dpi->num_copy_templates,
- &dpi->num_saved_scopes, dc);
+ d_count_templates_scopes (dpi, dc);
+ /* If we did not reach the recursion limit, then reset the
+ current recursion value back to 0, so that we can print
+ the templates. */
+ if (dpi->recursion < DEMANGLE_RECURSION_LIMIT)
+ dpi->recursion = 0;
dpi->num_copy_templates *= dpi->num_saved_scopes;
dpi->current_template = NULL;