From af03af8f55f2536b6e20928e6b1fa0324a5f3d6e Mon Sep 17 00:00:00 2001 From: Nick Clifton Date: Fri, 7 Dec 2018 11:32:55 +0000 Subject: Synchronize libiberty with gcc and add --no-recruse-limit option to tools that support name demangling. This patch addresses the multitude of bug reports about resource exhaustion in libiberty's name demangling code. It adds a limit to the amount of recursion that is allowed, before an error is triggered. It also adds a new demangling option to disable this limit. (The limit is enabled by default). PR 87681 PR 87675 PR 87636 PR 87335 libiberty * cp-demangle.h (struct d_info): Add recursion_limit field. * cp-demangle.c (d_function_type): If the recursion limit is enabled and reached, return with a failure result. (d_demangle_callback): If the recursion limit is enabled, check for a mangled string that is so long that there is not enough stack space for the local arrays. * cplus-dem.c (struct work): Add recursion_level field. (demangle_nested_args): If the recursion limit is enabled and reached, return with a failure result. include * demangle.h (DMGL_RECURSE_LIMIT): Define. (DEMANGLE_RECURSION_LIMIT): Prototype. binutuils * addr2line.c (demangle_flags): New static variable. (long_options): Add --recurse-limit and --no-recurse-limit. (translate_address): Pass demangle_flags to bfd_demangle. (main): Handle --recurse-limit and --no-recurse-limit options. * cxxfilt.c (flags): Add DMGL_RECURSE_LIMIT. (long_options): Add --recurse-limit and --no-recurse-limit. (main): Handle new options. * dlltool.c (gen_def_file): Include DMGL_RECURSE_LIMIT in flags passed to cplus_demangle. * nm.c (demangle_flags): New static variable. (long_options): Add --recurse-limit and --no-recurse-limit. (main): Handle new options. * objdump.c (demangle_flags): New static variable. (usage): Add --recurse-limit and --no-recurse-limit. (long_options): Likewise. (objdump_print_symname): Pass demangle_flags to bfd_demangle. (disassemble_section): Likewise. (dump_dymbols): Likewise. (main): Handle new options. * prdbg.c (demangle_flags): New static variable. (tg_variable): Pass demangle_flags to demangler. (tg_start_function): Likewise. * stabs.c (demangle_flags): New static variable. (stab_demangle_template): Pass demangle_flags to demangler. (stab_demangle_v3_argtypes): Likewise. (stab_demangle_v3_arg): Likewise. * doc/binutuls.texi: Document new command line options. * NEWS: Mention the new feature. * testsuite/config/default.exp (CXXFILT): Define if not already defined. (CXXFILTFLAGS): Likewise. * testsuite/binutils-all/cxxfilt.exp: New file. Runs a few simple tests of the cxxfilt program. --- binutils/NEWS | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'binutils/NEWS') diff --git a/binutils/NEWS b/binutils/NEWS index a3ee86e..ce92534 100644 --- a/binutils/NEWS +++ b/binutils/NEWS @@ -1,5 +1,16 @@ -*- text -*- +* The addr2line, c++filt, nm and objdump tools now have a limit on the + maximum amount of recursion that is allowed whilst demangling strings. + The value for this limit is defined by the DEMANGLE_RECRUSE_LIMIT + constant declared in the include/demangle.h header file. At the time + of writing this constant has the value of 1024. + + The --no-recurse-limit option can be used to remove the limit, restoring + the behaviour of earlier versions of these tools. This may be needed in + order to dmangle truly complicated names, but it also leaves the tools + vulnerable to stack exhaustion from maliciously constructed mangled names. + * Objdump's --disassemble option can now take a parameter, specifying the starting symbol for disassembly. Disassembly will continue from this symbol up to the next symbol. -- cgit v1.1