| Summary: | libiberty :stack overflow in nm | ||
|---|---|---|---|
| Product: | gcc | Reporter: | spinpx <spinpx> |
| Component: | other | Assignee: | Not yet assigned to anyone <unassigned> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | nickc, trupti_pardeshi |
| Priority: | P3 | ||
| Version: | unknown | ||
| Target Milestone: | --- | ||
| Host: | Target: | ||
| Build: | Known to work: | ||
| Known to fail: | Last reconfirmed: | 2019-03-21 00:00:00 | |
| Attachments: | inputs trigger bugs | ||
|
Description
spinpx
2019-02-19 05:08:36 UTC
the code is from binutils: https://github.com/bminor/binutils-gdb/tree/master/libiberty git commit: 388a192d73df7439bf375d8b8042bb53a6be9c60 It can be reproduced in bintuils commit c72e75a64030b0f6535a80481f37968ad55c333a (Feb 19 2019) CVE-2019-9071 This issue is similar to CVE-2018-18700 & CVE-2018-18701 So many similar cases and repetitive CVEs. This problem has been fixed before, but it has not been completely fixed. https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85122 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85452 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=87335 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=87636 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=87675 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=87681 I have proposed a patch to fix this bug: https://gcc.gnu.org/ml/gcc-patches/2019-03/msg01048.html Author: nickc Date: Wed Apr 10 14:44:47 2019 New Revision: 270258 URL: https://gcc.gnu.org/viewcvs?rev=270258&root=gcc&view=rev Log: Fix a stack exhaustion bug in libiberty's demangler when decoding a pathalogically constructed mangled name. PR 89394 * cp-demangle.c (cplus_demangle_fill_name): Reject negative lengths. (d_count_templates_scopes): Replace num_templates and num_scopes parameters with a struct d_print_info pointer parameter. Adjust body of the function accordingly. Add recursion counter and check that the recursion limit is not reached. (d_print_init): Pass dpi parameter to d_count_templates_scopes. Reset recursion counter afterwards, unless the recursion limit was reached. Modified: trunk/libiberty/ChangeLog trunk/libiberty/cp-demangle.c The patch has now been committed. May I know, in which version of binutils this fix is available? Any heads up will be appreciated. Best Regards, (In reply to Trupti Pardeshi from comment #9) > May I know, in which version of binutils this fix is available? 2.35. Which should be available in August, all being well. Cheers Nick PS. The fix is already in the mainline development code, so you can always clone the repository and build your own toolchain. (In reply to Nick Clifton from comment #10) > (In reply to Trupti Pardeshi from comment #9) > > May I know, in which version of binutils this fix is available? > > 2.35. Which should be available in August, all being well. > > Cheers > Nick > > PS. The fix is already in the mainline development code, so you can always > clone the repository and build your own toolchain. Thank you so much Nick for reply. We rely on binutils released version which will have fixes against CVEs. So, needed to confirm. Thanks you so much. |