git
/
gcc
mirror of git://gcc.gnu.org/git/gcc.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Demangler integer overflow fixes from Marcel Böhme. 

PR c++/70498
	* cp-demangle.c: Parse numbers as integer instead of long to avoid
	overflow after sanity checks. Include <limits.h> if available.
	(INT_MAX): Define if necessary.
	(d_make_template_param): Takes integer argument instead of long.
	(d_make_function_param): Likewise.
	(d_append_num): Likewise.
	(d_identifier): Likewise.
	(d_number): Parse as and return integer.
	(d_compact_number): Handle overflow.
	(d_source_name): Change variable type to integer for parsed number.
	(d_java_resource): Likewise.
	(d_special_name): Likewise.
	(d_discriminator): Likewise.
	(d_unnamed_type): Likewise.
	* testsuite/demangle-expected: Add regression test cases.

From-SVN: r235767
This commit is contained in:
Marcel Böhme 2016-05-02 17:06:40 +00:00 committed by Bernd Schmidt
parent 818b88a7a1
commit bfbc839a0b
3 changed files with 61 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
libiberty/ChangeLog
View File

@ -1,3 +1,22 @@
2016-05-02 Marcel Böhme <boehme.marcel@gmail.com>
PR c++/70498
* cp-demangle.c: Parse numbers as integer instead of long to avoid
overflow after sanity checks. Include <limits.h> if available.
(INT_MAX): Define if necessary.
(d_make_template_param): Takes integer argument instead of long.
(d_make_function_param): Likewise.
(d_append_num): Likewise.
(d_identifier): Likewise.
(d_number): Parse as and return integer.
(d_compact_number): Handle overflow.
(d_source_name): Change variable type to integer for parsed number.
(d_java_resource): Likewise.
(d_special_name): Likewise.
(d_discriminator): Likewise.
(d_unnamed_type): Likewise.
* testsuite/demangle-expected: Add regression test cases.
2016-04-30 Oleg Endo <olegendo@gcc.gnu.org> 2016-04-30 Oleg Endo <olegendo@gcc.gnu.org>
* configure: Remove SH5 support. * configure: Remove SH5 support.

52
libiberty/cp-demangle.c
View File

@ -128,6 +128,13 @@ extern char *alloca ();
# endif /* alloca */ # endif /* alloca */
#endif /* HAVE_ALLOCA_H */ #endif /* HAVE_ALLOCA_H */
#ifdef HAVE_LIMITS_H
#include <limits.h>
#endif
#ifndef INT_MAX
# define INT_MAX (int)(((unsigned int) ~0) >> 1) /* 0x7FFFFFFF */
#endif
#include "ansidecl.h" #include "ansidecl.h"
#include "libiberty.h" #include "libiberty.h"
#include "demangle.h" #include "demangle.h"
@ -398,7 +405,7 @@ d_make_dtor (struct d_info *, enum gnu_v3_dtor_kinds,
struct demangle_component *); struct demangle_component *);
static struct demangle_component * static struct demangle_component *
d_make_template_param (struct d_info *, long); d_make_template_param (struct d_info *, int);
static struct demangle_component * static struct demangle_component *
d_make_sub (struct d_info *, const char *, int); d_make_sub (struct d_info *, const char *, int);
@ -421,9 +428,9 @@ static struct demangle_component *d_unqualified_name (struct d_info *);
static struct demangle_component *d_source_name (struct d_info *); static struct demangle_component *d_source_name (struct d_info *);
static long d_number (struct d_info *); static int d_number (struct d_info *);
static struct demangle_component *d_identifier (struct d_info *, long); static struct demangle_component *d_identifier (struct d_info *, int);
static struct demangle_component *d_operator_name (struct d_info *); static struct demangle_component *d_operator_name (struct d_info *);
@ -1119,7 +1126,7 @@ d_make_dtor (struct d_info *di, enum gnu_v3_dtor_kinds kind,
/* Add a new template parameter. */ /* Add a new template parameter. */
static struct demangle_component * static struct demangle_component *
d_make_template_param (struct d_info *di, long i) d_make_template_param (struct d_info *di, int i)
{ {
struct demangle_component *p; struct demangle_component *p;
@ -1135,7 +1142,7 @@ d_make_template_param (struct d_info *di, long i)
/* Add a new function parameter. */ /* Add a new function parameter. */
static struct demangle_component * static struct demangle_component *
d_make_function_param (struct d_info *di, long i) d_make_function_param (struct d_info *di, int i)
{ {
struct demangle_component *p; struct demangle_component *p;
@ -1620,7 +1627,7 @@ d_unqualified_name (struct d_info *di)
static struct demangle_component * static struct demangle_component *
d_source_name (struct d_info *di) d_source_name (struct d_info *di)
{ {
long len; int len;
struct demangle_component *ret; struct demangle_component *ret;
len = d_number (di); len = d_number (di);
@ -1633,12 +1640,12 @@ d_source_name (struct d_info *di)
/* number ::= [n] <(non-negative decimal integer)> */ /* number ::= [n] <(non-negative decimal integer)> */
static long static int
d_number (struct d_info *di) d_number (struct d_info *di)
{ {
int negative; int negative;
char peek; char peek;
long ret; int ret;
negative = 0; negative = 0;
peek = d_peek_char (di); peek = d_peek_char (di);
@ -1681,7 +1688,7 @@ d_number_component (struct d_info *di)
/* identifier ::= <(unqualified source code identifier)> */ /* identifier ::= <(unqualified source code identifier)> */
static struct demangle_component * static struct demangle_component *
d_identifier (struct d_info *di, long len) d_identifier (struct d_info *di, int len)
{ {
const char *name; const char *name;
@ -1702,7 +1709,7 @@ d_identifier (struct d_info *di, long len)
/* Look for something which looks like a gcc encoding of an /* Look for something which looks like a gcc encoding of an
anonymous namespace, and replace it with a more user friendly anonymous namespace, and replace it with a more user friendly
name. */ name. */
if (len >= (long) ANONYMOUS_NAMESPACE_PREFIX_LEN + 2 if (len >= (int) ANONYMOUS_NAMESPACE_PREFIX_LEN + 2
&& memcmp (name, ANONYMOUS_NAMESPACE_PREFIX, && memcmp (name, ANONYMOUS_NAMESPACE_PREFIX,
ANONYMOUS_NAMESPACE_PREFIX_LEN) == 0) ANONYMOUS_NAMESPACE_PREFIX_LEN) == 0)
{ {
@ -1870,7 +1877,7 @@ d_java_resource (struct d_info *di)
{ {
struct demangle_component *p = NULL; struct demangle_component *p = NULL;
struct demangle_component *next = NULL; struct demangle_component *next = NULL;
long len, i; int len, i;
char c; char c;
const char *str; const char *str;
@ -2012,7 +2019,7 @@ d_special_name (struct d_info *di)
case 'C': case 'C':
{ {
struct demangle_component *derived_type; struct demangle_component *derived_type;
long offset; int offset;
struct demangle_component *base_type; struct demangle_component *base_type;
derived_type = cplus_demangle_type (di); derived_type = cplus_demangle_type (di);
@ -2946,10 +2953,10 @@ d_pointer_to_member_type (struct d_info *di)
/* <non-negative number> _ */ /* <non-negative number> _ */
static long static int
d_compact_number (struct d_info *di) d_compact_number (struct d_info *di)
{ {
long num; int num;
if (d_peek_char (di) == '_') if (d_peek_char (di) == '_')
num = 0; num = 0;
else if (d_peek_char (di) == 'n') else if (d_peek_char (di) == 'n')
@ -2957,7 +2964,7 @@ d_compact_number (struct d_info *di)
else else
num = d_number (di) + 1; num = d_number (di) + 1;
if (! d_check_char (di, '_')) if (num < 0 || ! d_check_char (di, '_'))
return -1; return -1;
return num; return num;
} }
@ -2969,7 +2976,7 @@ d_compact_number (struct d_info *di)
static struct demangle_component * static struct demangle_component *
d_template_param (struct d_info *di) d_template_param (struct d_info *di)
{ {
long param; int param;
if (! d_check_char (di, 'T')) if (! d_check_char (di, 'T'))
return NULL; return NULL;
@ -3171,9 +3178,10 @@ d_expression_1 (struct d_info *di)
} }
else else
{ {
index = d_compact_number (di) + 1; index = d_compact_number (di);
if (index == 0) if (index == INT_MAX || index == -1)
return NULL; return NULL;
index ++;
} }
return d_make_function_param (di, index); return d_make_function_param (di, index);
} }
@ -3502,7 +3510,7 @@ d_local_name (struct d_info *di)
static int static int
d_discriminator (struct d_info *di) d_discriminator (struct d_info *di)
{ {
long discrim; int discrim;
if (d_peek_char (di) != '_') if (d_peek_char (di) != '_')
return 1; return 1;
@ -3558,7 +3566,7 @@ static struct demangle_component *
d_unnamed_type (struct d_info *di) d_unnamed_type (struct d_info *di)
{ {
struct demangle_component *ret; struct demangle_component *ret;
long num; int num;
if (! d_check_char (di, 'U')) if (! d_check_char (di, 'U'))
return NULL; return NULL;
@ -4086,10 +4094,10 @@ d_append_string (struct d_print_info *dpi, const char *s)
} }
static inline void static inline void
d_append_num (struct d_print_info *dpi, long l) d_append_num (struct d_print_info *dpi, int l)
{ {
char buf[25]; char buf[25];
sprintf (buf,"%ld", l); sprintf (buf,"%d", l);
d_append_string (dpi, buf); d_append_string (dpi, buf);
} }

14
libiberty/testsuite/demangle-expected
View File

@ -4422,12 +4422,22 @@ void baz<int>(A<sizeof (foo((int)(), (floatcomplex )00000000_00000000))>*)
_Z3fooI1FEN1XIXszdtcl1PclcvT__EEE5arrayEE4TypeEv _Z3fooI1FEN1XIXszdtcl1PclcvT__EEE5arrayEE4TypeEv
X<sizeof ((P(((F)())())).array)>::Type foo<F>() X<sizeof ((P(((F)())())).array)>::Type foo<F>()
# #
# Tests a use-after-free problem # Tests a use-after-free problem PR70481
_Q.__0 _Q.__0
::Q.(void) ::Q.(void)
# #
# Tests a use-after-free problem # Tests a use-after-free problem PR70481
_Q10-__9cafebabe. _Q10-__9cafebabe.
cafebabe.::-(void) cafebabe.::-(void)
#
# Tests integer overflow problem PR70492
__vt_90000000000cafebabe
__vt_90000000000cafebabe
#
# Tests write access violation PR70498
_Z80800000000000000000000
_Z80800000000000000000000