diff -rup binutils.orig/include/demangle.h binutils-2.27/include/demangle.h
--- binutils.orig/include/demangle.h 2019-01-08 13:52:32.990714670 +0000
+++ binutils-2.27/include/demangle.h 2019-01-08 13:58:42.269743403 +0000
@@ -64,9 +64,20 @@ extern "C" {
#define DMGL_GNAT (1 << 15)
#define DMGL_DLANG (1 << 16)
+/* Disable a limit on the depth of recursion in mangled strings.
+ Note if this limit is disabled then stack exhaustion is possible when
+ demangling pathologically complicated strings. Bug reports about stack
+ exhaustion when the option is enabled will be rejected. */
+#define DMGL_NO_RECURSE_LIMIT (1 << 17)
+
/* If none of these are set, use 'current_demangling_style' as the default. */
#define DMGL_STYLE_MASK (DMGL_AUTO|DMGL_GNU|DMGL_LUCID|DMGL_ARM|DMGL_HP|DMGL_EDG|DMGL_GNU_V3|DMGL_JAVA|DMGL_GNAT|DMGL_DLANG)
+/* If DMGL_NO_RECURSE_LIMIT is not enabled, then this is the value used as
+ the maximum depth of recursion allowed. It should be enough for any
+ real-world mangled name. */
+#define DEMANGLE_RECURSION_LIMIT 2048
+
/* Enumeration of possible demangling styles.
Lucid and ARM styles are still kept logically distinct, even though
Only in binutils-2.27/include: demangle.h.orig
Only in binutils-2.27/include: #demangle.h.rej#
Only in binutils-2.27/include: .#demangle.h.rej
Only in binutils-2.27/include: demangle.h.rej
diff -rup binutils.orig/libiberty/cp-demangle.c binutils-2.27/libiberty/cp-demangle.c
--- binutils.orig/libiberty/cp-demangle.c 2019-01-08 13:52:33.161713294 +0000
+++ binutils-2.27/libiberty/cp-demangle.c 2019-01-08 13:53:30.002255949 +0000
@@ -2725,21 +2725,35 @@ d_ref_qualifier (struct d_info *di, stru
static struct demangle_component *
d_function_type (struct d_info *di)
{
- struct demangle_component *ret;
+ struct demangle_component *ret = NULL;
- if (! d_check_char (di, 'F'))
- return NULL;
- if (d_peek_char (di) == 'Y')
+ if ((di->options & DMGL_NO_RECURSE_LIMIT) == 0)
{
- /* Function has C linkage. We don't print this information.
- FIXME: We should print it in verbose mode. */
- d_advance (di, 1);
+ if (di->recursion_level > DEMANGLE_RECURSION_LIMIT)
+ /* FIXME: There ought to be a way to report
+ that the recursion limit has been reached. */
+ return NULL;
+
+ di->recursion_level ++;
}
- ret = d_bare_function_type (di, 1);
- ret = d_ref_qualifier (di, ret);
- if (! d_check_char (di, 'E'))
- return NULL;
+ if (d_check_char (di, 'F'))
+ {
+ if (d_peek_char (di) == 'Y')
+ {
+ /* Function has C linkage. We don't print this information.
+ FIXME: We should print it in verbose mode. */
+ d_advance (di, 1);
+ }
+ ret = d_bare_function_type (di, 1);
+ ret = d_ref_qualifier (di, ret);
+
+ if (! d_check_char (di, 'E'))
+ ret = NULL;
+ }
+
+ if ((di->options & DMGL_NO_RECURSE_LIMIT) == 0)
+ di->recursion_level --;
return ret;
}
@@ -5898,6 +5912,7 @@ cplus_demangle_init_info (const char *ma
di->expansion = 0;
di->is_expression = 0;
di->is_conversion = 0;
+ di->recursion_level = 0;
}
/* Internal implementation for the demangler. If MANGLED is a g++ v3 ABI
@@ -5937,6 +5952,20 @@ d_demangle_callback (const char *mangled
cplus_demangle_init_info (mangled, options, strlen (mangled), &di);
+ /* PR 87675 - Check for a mangled string that is so long
+ that we do not have enough stack space to demangle it. */
+ if (((options & DMGL_NO_RECURSE_LIMIT) == 0)
+ /* This check is a bit arbitrary, since what we really want to do is to
+ compare the sizes of the di.comps and di.subs arrays against the
+ amount of stack space remaining. But there is no portable way to do
+ this, so instead we use the recursion limit as a guide to the maximum
+ size of the arrays. */
+ && (unsigned long) di.num_comps > DEMANGLE_RECURSION_LIMIT)
+ {
+ /* FIXME: We need a way to indicate that a stack limit has been reached. */
+ return 0;
+ }
+
{
#ifdef CP_DYNAMIC_ARRAYS
__extension__ struct demangle_component comps[di.num_comps];
Only in binutils-2.27/libiberty: cp-demangle.c.orig
diff -rup binutils.orig/libiberty/cp-demangle.h binutils-2.27/libiberty/cp-demangle.h
--- binutils.orig/libiberty/cp-demangle.h 2019-01-08 13:52:33.161713294 +0000
+++ binutils-2.27/libiberty/cp-demangle.h 2019-01-08 13:53:30.003255941 +0000
@@ -127,6 +127,9 @@ struct d_info
/* Non-zero if we are parsing the type operand of a conversion
operator, but not when in an expression. */
int is_conversion;
+ /* If DMGL_NO_RECURSE_LIMIT is not active then this is set to
+ the current recursion level. */
+ unsigned int recursion_level;
};
/* To avoid running past the ending '\0', don't:
Only in binutils-2.27/libiberty: cp-demangle.h.orig
diff -rup binutils.orig/libiberty/cplus-dem.c binutils-2.27/libiberty/cplus-dem.c
--- binutils.orig/libiberty/cplus-dem.c 2019-01-08 13:52:33.161713294 +0000
+++ binutils-2.27/libiberty/cplus-dem.c 2019-01-08 14:10:00.057340821 +0000
@@ -137,6 +137,7 @@ struct work_stuff
string* previous_argument; /* The last function argument demangled. */
int nrepeats; /* The number of times to repeat the previous
argument. */
+ unsigned int recursion_level;
};
#define PRINT_ANSI_QUALIFIERS (work -> options & DMGL_ANSI)
@@ -1237,11 +1238,15 @@ squangle_mop_up (struct work_stuff *work
{
free ((char *) work -> btypevec);
work->btypevec = NULL;
+ work->bsize = 0;
+ work->numb = 0;
}
if (work -> ktypevec != NULL)
{
free ((char *) work -> ktypevec);
work->ktypevec = NULL;
+ work->ksize = 0;
+ work->numk = 0;
}
}
@@ -1275,8 +1280,15 @@ work_stuff_copy_to_from (struct work_stu
for (i = 0; i < from->numk; i++)
{
- int len = strlen (from->ktypevec[i]) + 1;
+ int len;
+ if (from->ktypevec[i] == NULL)
+ {
+ to->ktypevec[i] = NULL;
+ continue;
+ }
+
+ len = strlen (from->ktypevec[i]) + 1;
to->ktypevec[i] = XNEWVEC (char, len);
memcpy (to->ktypevec[i], from->ktypevec[i], len);
}
@@ -1286,8 +1298,15 @@ work_stuff_copy_to_from (struct work_stu
for (i = 0; i < from->numb; i++)
{
- int len = strlen (from->btypevec[i]) + 1;
+ int len;
+ if (from->btypevec[i] == NULL)
+ {
+ to->btypevec[i] = NULL;
+ continue;
+ }
+
+ len = strlen (from->btypevec[i]) + 1;
to->btypevec[i] = XNEWVEC (char , len);
memcpy (to->btypevec[i], from->btypevec[i], len);
}
@@ -1335,6 +1354,7 @@ delete_non_B_K_work_stuff (struct work_s
free ((char*) work->tmpl_argvec);
work->tmpl_argvec = NULL;
+ work->ntmpl_args = 0;
}
if (work->previous_argument)
{
@@ -3347,6 +3367,20 @@ demangle_qualified (struct work_stuff *w
success = 0;
}
+ if ((work->options & DMGL_NO_RECURSE_LIMIT) == 0)
+ {
+ /* PR 87241: Catch malicious input that will try to trick this code into
+ allocating a ridiculous amount of memory via the remember_Ktype()
+ function.
+ The choice of DEMANGLE_RECURSION_LIMIT is somewhat arbitrary. Possibly
+ a better solution would be to track how much memory remember_Ktype
+ allocates and abort when some upper limit is reached. */
+ if (qualifiers > DEMANGLE_RECURSION_LIMIT)
+ /* FIXME: We ought to have some way to tell the user that
+ this limit has been reached. */
+ success = 0;
+ }
+
if (!success)
return success;
@@ -4335,6 +4369,7 @@ remember_Btype (struct work_stuff *work,
}
/* Lose all the info related to B and K type codes. */
+
static void
forget_B_and_K_types (struct work_stuff *work)
{
@@ -4360,6 +4395,7 @@ forget_B_and_K_types (struct work_stuff
}
}
}
+
/* Forget the remembered types, but not the type vector itself. */
static void
@@ -4551,6 +4587,16 @@ demangle_nested_args (struct work_stuff
int result;
int saved_nrepeats;
+ if ((work->options & DMGL_NO_RECURSE_LIMIT) == 0)
+ {
+ if (work->recursion_level > DEMANGLE_RECURSION_LIMIT)
+ /* FIXME: There ought to be a way to report
+ that the recursion limit has been reached. */
+ return 0;
+
+ work->recursion_level ++;
+ }
+
/* The G++ name-mangling algorithm does not remember types on nested
argument lists, unless -fsquangling is used, and in that case the
type vector updated by remember_type is not used. So, we turn
@@ -4577,6 +4623,9 @@ demangle_nested_args (struct work_stuff
--work->forgetting_types;
work->nrepeats = saved_nrepeats;
+ if ((work->options & DMGL_NO_RECURSE_LIMIT) == 0)
+ --work->recursion_level;
+
return result;
}
Only in binutils-2.27/libiberty: cplus-dem.c.orig
Only in binutils-2.27/libiberty: cplus-dem.c.rej