Brad Bishop | 96ff198 | 2019-08-19 13:50:42 -0400 | [diff] [blame^] | 1 | From c1202057eb9161a86af27d867703235fee7b7555 Mon Sep 17 00:00:00 2001 |
| 2 | From: Nick Clifton <nickc@redhat.com> |
| 3 | Date: Wed, 10 Apr 2019 15:49:36 +0100 |
| 4 | Subject: [PATCH] Pull in patch for libiberty that fixes a stack exhaustion bug |
| 5 | when demangling a pathalogically constructed mangled name. |
| 6 | |
| 7 | PR 89394 |
| 8 | * cp-demangle.c (cplus_demangle_fill_name): Reject negative |
| 9 | lengths. |
| 10 | (d_count_templates_scopes): Replace num_templates and num_scopes |
| 11 | parameters with a struct d_print_info pointer parameter. Adjust |
| 12 | body of the function accordingly. Add recursion counter and check |
| 13 | that the recursion limit is not reached. |
| 14 | (d_print_init): Pass dpi parameter to d_count_templates_scopes. |
| 15 | Reset recursion counter afterwards, unless the recursion limit was |
| 16 | reached. |
| 17 | |
| 18 | CVE: CVE-2019-9071 |
| 19 | CVE: CVE-2019-9070 |
| 20 | Upstream-Status: Backport |
| 21 | Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> |
| 22 | --- |
| 23 | ChangeLog | 16 ++++++++++++++ |
| 24 | libiberty/cp-demangle.c | 48 ++++++++++++++++++++++------------------- |
| 25 | 2 files changed, 42 insertions(+), 22 deletions(-) |
| 26 | |
| 27 | diff --git a/ChangeLog b/ChangeLog |
| 28 | index cd631a15b6..4df3aaa62c 100644 |
| 29 | --- a/ChangeLog |
| 30 | +++ b/ChangeLog |
| 31 | @@ -1,3 +1,19 @@ |
| 32 | +2019-04-10 Nick Clifton <nickc@redhat.com> |
| 33 | + |
| 34 | + * libiberty: Sync with gcc. Bring in: |
| 35 | + 2019-04-10 Nick Clifton <nickc@redhat.com> |
| 36 | + |
| 37 | + PR 89394 |
| 38 | + * cp-demangle.c (cplus_demangle_fill_name): Reject negative |
| 39 | + lengths. |
| 40 | + (d_count_templates_scopes): Replace num_templates and num_scopes |
| 41 | + parameters with a struct d_print_info pointer parameter. Adjust |
| 42 | + body of the function accordingly. Add recursion counter and check |
| 43 | + that the recursion limit is not reached. |
| 44 | + (d_print_init): Pass dpi parameter to d_count_templates_scopes. |
| 45 | + Reset recursion counter afterwards, unless the recursion limit was |
| 46 | + reached. |
| 47 | + |
| 48 | 2018-06-24 Nick Clifton <nickc@redhat.com> |
| 49 | |
| 50 | 2.32 branch created. |
| 51 | diff --git a/libiberty/cp-demangle.c b/libiberty/cp-demangle.c |
| 52 | index b34b485692..779b4e763a 100644 |
| 53 | --- a/libiberty/cp-demangle.c |
| 54 | +++ b/libiberty/cp-demangle.c |
| 55 | @@ -861,7 +861,7 @@ CP_STATIC_IF_GLIBCPP_V3 |
| 56 | int |
| 57 | cplus_demangle_fill_name (struct demangle_component *p, const char *s, int len) |
| 58 | { |
| 59 | - if (p == NULL || s == NULL || len == 0) |
| 60 | + if (p == NULL || s == NULL || len <= 0) |
| 61 | return 0; |
| 62 | p->d_printing = 0; |
| 63 | p->type = DEMANGLE_COMPONENT_NAME; |
| 64 | @@ -4061,7 +4061,7 @@ d_growable_string_callback_adapter (const char *s, size_t l, void *opaque) |
| 65 | are larger than the actual numbers encountered. */ |
| 66 | |
| 67 | static void |
| 68 | -d_count_templates_scopes (int *num_templates, int *num_scopes, |
| 69 | +d_count_templates_scopes (struct d_print_info *dpi, |
| 70 | const struct demangle_component *dc) |
| 71 | { |
| 72 | if (dc == NULL) |
| 73 | @@ -4081,13 +4081,13 @@ d_count_templates_scopes (int *num_templates, int *num_scopes, |
| 74 | break; |
| 75 | |
| 76 | case DEMANGLE_COMPONENT_TEMPLATE: |
| 77 | - (*num_templates)++; |
| 78 | + dpi->num_copy_templates++; |
| 79 | goto recurse_left_right; |
| 80 | |
| 81 | case DEMANGLE_COMPONENT_REFERENCE: |
| 82 | case DEMANGLE_COMPONENT_RVALUE_REFERENCE: |
| 83 | if (d_left (dc)->type == DEMANGLE_COMPONENT_TEMPLATE_PARAM) |
| 84 | - (*num_scopes)++; |
| 85 | + dpi->num_saved_scopes++; |
| 86 | goto recurse_left_right; |
| 87 | |
| 88 | case DEMANGLE_COMPONENT_QUAL_NAME: |
| 89 | @@ -4152,42 +4152,42 @@ d_count_templates_scopes (int *num_templates, int *num_scopes, |
| 90 | case DEMANGLE_COMPONENT_TAGGED_NAME: |
| 91 | case DEMANGLE_COMPONENT_CLONE: |
| 92 | recurse_left_right: |
| 93 | - d_count_templates_scopes (num_templates, num_scopes, |
| 94 | - d_left (dc)); |
| 95 | - d_count_templates_scopes (num_templates, num_scopes, |
| 96 | - d_right (dc)); |
| 97 | + /* PR 89394 - Check for too much recursion. */ |
| 98 | + if (dpi->recursion > DEMANGLE_RECURSION_LIMIT) |
| 99 | + /* FIXME: There ought to be a way to report to the |
| 100 | + user that the recursion limit has been reached. */ |
| 101 | + return; |
| 102 | + |
| 103 | + ++ dpi->recursion; |
| 104 | + d_count_templates_scopes (dpi, d_left (dc)); |
| 105 | + d_count_templates_scopes (dpi, d_right (dc)); |
| 106 | + -- dpi->recursion; |
| 107 | break; |
| 108 | |
| 109 | case DEMANGLE_COMPONENT_CTOR: |
| 110 | - d_count_templates_scopes (num_templates, num_scopes, |
| 111 | - dc->u.s_ctor.name); |
| 112 | + d_count_templates_scopes (dpi, dc->u.s_ctor.name); |
| 113 | break; |
| 114 | |
| 115 | case DEMANGLE_COMPONENT_DTOR: |
| 116 | - d_count_templates_scopes (num_templates, num_scopes, |
| 117 | - dc->u.s_dtor.name); |
| 118 | + d_count_templates_scopes (dpi, dc->u.s_dtor.name); |
| 119 | break; |
| 120 | |
| 121 | case DEMANGLE_COMPONENT_EXTENDED_OPERATOR: |
| 122 | - d_count_templates_scopes (num_templates, num_scopes, |
| 123 | - dc->u.s_extended_operator.name); |
| 124 | + d_count_templates_scopes (dpi, dc->u.s_extended_operator.name); |
| 125 | break; |
| 126 | |
| 127 | case DEMANGLE_COMPONENT_FIXED_TYPE: |
| 128 | - d_count_templates_scopes (num_templates, num_scopes, |
| 129 | - dc->u.s_fixed.length); |
| 130 | + d_count_templates_scopes (dpi, dc->u.s_fixed.length); |
| 131 | break; |
| 132 | |
| 133 | case DEMANGLE_COMPONENT_GLOBAL_CONSTRUCTORS: |
| 134 | case DEMANGLE_COMPONENT_GLOBAL_DESTRUCTORS: |
| 135 | - d_count_templates_scopes (num_templates, num_scopes, |
| 136 | - d_left (dc)); |
| 137 | + d_count_templates_scopes (dpi, d_left (dc)); |
| 138 | break; |
| 139 | |
| 140 | case DEMANGLE_COMPONENT_LAMBDA: |
| 141 | case DEMANGLE_COMPONENT_DEFAULT_ARG: |
| 142 | - d_count_templates_scopes (num_templates, num_scopes, |
| 143 | - dc->u.s_unary_num.sub); |
| 144 | + d_count_templates_scopes (dpi, dc->u.s_unary_num.sub); |
| 145 | break; |
| 146 | } |
| 147 | } |
| 148 | @@ -4222,8 +4222,12 @@ d_print_init (struct d_print_info *dpi, demangle_callbackref callback, |
| 149 | dpi->next_copy_template = 0; |
| 150 | dpi->num_copy_templates = 0; |
| 151 | |
| 152 | - d_count_templates_scopes (&dpi->num_copy_templates, |
| 153 | - &dpi->num_saved_scopes, dc); |
| 154 | + d_count_templates_scopes (dpi, dc); |
| 155 | + /* If we did not reach the recursion limit, then reset the |
| 156 | + current recursion value back to 0, so that we can print |
| 157 | + the templates. */ |
| 158 | + if (dpi->recursion < DEMANGLE_RECURSION_LIMIT) |
| 159 | + dpi->recursion = 0; |
| 160 | dpi->num_copy_templates *= dpi->num_saved_scopes; |
| 161 | |
| 162 | dpi->current_template = NULL; |
| 163 | -- |
| 164 | 2.20.1 |
| 165 | |