Fix for PR70498 in Libiberty Demangler
Marcel Böhme
boehme.marcel@gmail.com
Sun May 1 16:25:00 GMT 2016
> On 28 Apr 2016, at 12:28 AM, Bernd Schmidt <bschmidt@redhat.com> wrote:
>
> Please attach it (text/plain) instead.
Done.
Index: libiberty/ChangeLog
===================================================================
--- libiberty/ChangeLog (revision 235691)
+++ libiberty/ChangeLog (working copy)
@@ -1,3 +1,22 @@
+2016-04-16 Marcel Böhme <boehme.marcel@gmail.com>
+
+ PR c++/70498
+ * cp-demangle.c: Parse numbers as integer instead of long to avoid
+ overflow after sanity checks. Include <limits.h> if available.
+ (INT_MAX): Define if necessary.
+ (d_make_template_param): Takes integer argument instead of long.
+ (d_make_function_param): Likewise.
+ (d_append_num): Likewise.
+ (d_identifier): Likewise.
+ (d_number): Parse as and return integer.
+ (d_compact_number): Handle overflow.
+ (d_source_name): Change variable type to integer for parsed number.
+ (d_java_resource): Likewise.
+ (d_special_name): Likewise.
+ (d_discriminator): Likewise.
+ (d_unnamed_type): Likewise.
+ * testsuite/demangle-expected: Add regression test cases.
+
2016-04-30 Oleg Endo <olegendo@gcc.gnu.org>
* configure: Remove SH5 support.
Index: libiberty/cp-demangle.c
===================================================================
--- libiberty/cp-demangle.c (revision 235691)
+++ libiberty/cp-demangle.c (working copy)
@@ -128,6 +128,13 @@
# endif /* alloca */
#endif /* HAVE_ALLOCA_H */
+#ifdef HAVE_LIMITS_H
+#include <limits.h>
+#endif
+#ifndef INT_MAX
+# define INT_MAX (int)(((unsigned int) ~0) >> 1) /* 0x7FFFFFFF */
+#endif
+
#include "ansidecl.h"
#include "libiberty.h"
#include "demangle.h"
@@ -398,7 +405,7 @@
struct demangle_component *);
static struct demangle_component *
-d_make_template_param (struct d_info *, long);
+d_make_template_param (struct d_info *, int);
static struct demangle_component *
d_make_sub (struct d_info *, const char *, int);
@@ -421,9 +428,9 @@
static struct demangle_component *d_source_name (struct d_info *);
-static long d_number (struct d_info *);
+static int d_number (struct d_info *);
-static struct demangle_component *d_identifier (struct d_info *, long);
+static struct demangle_component *d_identifier (struct d_info *, int);
static struct demangle_component *d_operator_name (struct d_info *);
@@ -1119,7 +1126,7 @@
/* Add a new template parameter. */
static struct demangle_component *
-d_make_template_param (struct d_info *di, long i)
+d_make_template_param (struct d_info *di, int i)
{
struct demangle_component *p;
@@ -1135,7 +1142,7 @@
/* Add a new function parameter. */
static struct demangle_component *
-d_make_function_param (struct d_info *di, long i)
+d_make_function_param (struct d_info *di, int i)
{
struct demangle_component *p;
@@ -1620,7 +1627,7 @@
static struct demangle_component *
d_source_name (struct d_info *di)
{
- long len;
+ int len;
struct demangle_component *ret;
len = d_number (di);
@@ -1633,12 +1640,12 @@
/* number ::= [n] <(non-negative decimal integer)> */
-static long
+static int
d_number (struct d_info *di)
{
int negative;
char peek;
- long ret;
+ int ret;
negative = 0;
peek = d_peek_char (di);
@@ -1681,7 +1688,7 @@
/* identifier ::= <(unqualified source code identifier)> */
static struct demangle_component *
-d_identifier (struct d_info *di, long len)
+d_identifier (struct d_info *di, int len)
{
const char *name;
@@ -1702,7 +1709,7 @@
/* Look for something which looks like a gcc encoding of an
anonymous namespace, and replace it with a more user friendly
name. */
- if (len >= (long) ANONYMOUS_NAMESPACE_PREFIX_LEN + 2
+ if (len >= (int) ANONYMOUS_NAMESPACE_PREFIX_LEN + 2
&& memcmp (name, ANONYMOUS_NAMESPACE_PREFIX,
ANONYMOUS_NAMESPACE_PREFIX_LEN) == 0)
{
@@ -1870,7 +1877,7 @@
{
struct demangle_component *p = NULL;
struct demangle_component *next = NULL;
- long len, i;
+ int len, i;
char c;
const char *str;
@@ -2012,7 +2019,7 @@
case 'C':
{
struct demangle_component *derived_type;
- long offset;
+ int offset;
struct demangle_component *base_type;
derived_type = cplus_demangle_type (di);
@@ -2946,10 +2953,10 @@
/* <non-negative number> _ */
-static long
+static int
d_compact_number (struct d_info *di)
{
- long num;
+ int num;
if (d_peek_char (di) == '_')
num = 0;
else if (d_peek_char (di) == 'n')
@@ -2957,7 +2964,7 @@
else
num = d_number (di) + 1;
- if (! d_check_char (di, '_'))
+ if (num < 0 || ! d_check_char (di, '_'))
return -1;
return num;
}
@@ -2969,7 +2976,7 @@
static struct demangle_component *
d_template_param (struct d_info *di)
{
- long param;
+ int param;
if (! d_check_char (di, 'T'))
return NULL;
@@ -3171,9 +3178,10 @@
}
else
{
- index = d_compact_number (di) + 1;
- if (index == 0)
+ index = d_compact_number (di);
+ if (index == INT_MAX || index == -1)
return NULL;
+ index ++;
}
return d_make_function_param (di, index);
}
@@ -3502,7 +3510,7 @@
static int
d_discriminator (struct d_info *di)
{
- long discrim;
+ int discrim;
if (d_peek_char (di) != '_')
return 1;
@@ -3558,7 +3566,7 @@
d_unnamed_type (struct d_info *di)
{
struct demangle_component *ret;
- long num;
+ int num;
if (! d_check_char (di, 'U'))
return NULL;
@@ -4086,10 +4094,10 @@
}
static inline void
-d_append_num (struct d_print_info *dpi, long l)
+d_append_num (struct d_print_info *dpi, int l)
{
char buf[25];
- sprintf (buf,"%ld", l);
+ sprintf (buf,"%d", l);
d_append_string (dpi, buf);
}
Index: libiberty/testsuite/demangle-expected
===================================================================
--- libiberty/testsuite/demangle-expected (revision 235691)
+++ libiberty/testsuite/demangle-expected (working copy)
@@ -4422,12 +4422,22 @@
_Z3fooI1FEN1XIXszdtcl1PclcvT__EEE5arrayEE4TypeEv
X<sizeof ((P(((F)())())).array)>::Type foo<F>()
#
-# Tests a use-after-free problem
+# Tests a use-after-free problem PR70481
_Q.__0
::Q.(void)
#
-# Tests a use-after-free problem
+# Tests a use-after-free problem PR70481
_Q10-__9cafebabe.
cafebabe.::-(void)
+#
+# Tests integer overflow problem PR70492
+
+__vt_90000000000cafebabe
+__vt_90000000000cafebabe
+#
+# Tests write access violation PR70498
+
+_Z80800000000000000000000
+_Z80800000000000000000000
More information about the Gcc-patches
mailing list