cplus-dem.c (consume_count): If `count' wraps, return 0 and don't advance input pointer.

	* cplus-dem.c (consume_count): If `count' wraps, return 0 and
	don't advance input pointer.
	(demangle_class_name): If consume_count didn't find a count, do
	nothing.  Don't bother with `strlen' sanity check; consume_count
	does it for us.

From-SVN: r26068

1 files changed, 12 insertions, 2 deletions

diff --git a/libiberty/cplus-dem.c b/libiberty/cplus-dem.c
index a3eb85f..ec05edf 100644
--- a/libiberty/cplus-dem.c
+++ b/libiberty/cplus-dem.c
@@ -428,12 +428,22 @@ static int
 consume_count (type)
      const char **type;
 {
-  int count = 0;
+  unsigned int count = 0;
+  char *save = *type;
 
   while (isdigit ((unsigned char)**type))
     {
       count *= 10;
       count += **type - '0';
+      /* A sanity check.  Otherwise a symbol like
+	 `_Utf390_1__1_9223372036854775807__9223372036854775'
+	 can cause this function to return a negative value.
+	 In this case we just consume until the end of the string.  */
+      if (count > strlen (*type))
+	{
+	  *type = save;
+	  return 0;
+	}
       (*type)++;
     }
   return (count);
@@ -1946,7 +1956,7 @@ demangle_class_name (work, mangled, declp)
   int success = 0;
 
   n = consume_count (mangled);
-  if ((int) strlen (*mangled) >= n)
+  if (n > 0)
     {
       demangle_arm_hp_template (work, mangled, n, declp);
       success = 1;