This is the mail archive of the
gcc-bugs@gcc.gnu.org
mailing list for the GCC project.
[Bug c++/70481] [Regression] Libiberty Demangler segfaults
- From: "boehme.marcel at gmail dot com" <gcc-bugzilla at gcc dot gnu dot org>
- To: gcc-bugs at gcc dot gnu dot org
- Date: Thu, 31 Mar 2016 15:36:04 +0000
- Subject: [Bug c++/70481] [Regression] Libiberty Demangler segfaults
- Auto-submitted: auto-generated
- References: <bug-70481-4 at http dot gcc dot gnu dot org/bugzilla/>
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70481
--- Comment #2 from Marcel BÃhme <boehme.marcel at gmail dot com> ---
These are two distinct bugs. During fuzzing the btypevec bug appears more
often. But it seemed less critical since only NULL is written to the freed
memory:
work -> btypevec[ret] = NULL;
On the other hand, the ktypevec bug allows to write arbitrary content to the
freed memory:
work -> ktypevec[work -> numk++] = tem;
where tem is "cafebabe."
I used a more efficient version of the AFL fuzzer. Interestingly, I submitted
the same patch: https://gcc.gnu.org/ml/gcc-patches/2016-03/msg01687.html