stack overflow in debug_write_type

stack overflow in debug_write_type

[Alan Modra]

Another fuzzer attack.  This one was a "set" with elements using an
indirect type pointing back at the set.  The existing recursion check
only prevented simple recursion.

	* debug.c (struct debug_type_s): Add mark.
	(debug_write_type): Set mark and check before recursing into
	indirect types.

diff --git a/binutils/debug.c b/binutils/debug.c
index 53b45879e00..5cc77f74906 100644
--- a/binutils/debug.c
+++ b/binutils/debug.c
@@ -105,6 +105,8 @@ struct debug_type_s
   enum debug_type_kind kind;
   /* Size of type (0 if not known).  */
   unsigned int size;
+  /* Used by debug_write to stop DEBUG_KIND_INDIRECT infinite recursion.  */
+  unsigned int mark;
   /* Type which is a pointer to this type.  */
   debug_type pointer;
   /* Tagged union with additional information about the type.  */
@@ -2422,6 +2424,9 @@ debug_write_type (struct debug_handle *info,
   if (type == DEBUG_TYPE_NULL)
     return (*fns->empty_type) (fhandle);
 
+  /* Mark the type so that we don't define a type in terms of itself.  */
+  type->mark = info->mark;
+
   /* If we have a name for this type, just output it.  We only output
      typedef names after they have been defined.  We output type tags
      whenever we are not actually defining them.  */
@@ -2485,7 +2490,7 @@ debug_write_type (struct debug_handle *info,
       return false;
     case DEBUG_KIND_INDIRECT:
       /* Prevent infinite recursion.  */
-      if (*type->u.kindirect->slot == type)
+      if ((*type->u.kindirect->slot)->mark == info->mark)
 	return (*fns->empty_type) (fhandle);
       return debug_write_type (info, fns, fhandle, *type->u.kindirect->slot,
 			       name);

-- 
Alan Modra
Australia Development Lab, IBM

Re: stack overflow in debug_write_type

[Alan Modra]

Apparently u.kindirect->slot can point at a NULL.

	* debug.c (debug_write_type): Don't segfault on NULL indirect.

diff --git a/binutils/debug.c b/binutils/debug.c
index 5cc77f74906..bb26d9143d0 100644
--- a/binutils/debug.c
+++ b/binutils/debug.c
@@ -2490,7 +2490,8 @@ debug_write_type (struct debug_handle *info,
       return false;
     case DEBUG_KIND_INDIRECT:
       /* Prevent infinite recursion.  */
-      if ((*type->u.kindirect->slot)->mark == info->mark)
+      if (*type->u.kindirect->slot != DEBUG_TYPE_NULL
+	  && (*type->u.kindirect->slot)->mark == info->mark)
 	return (*fns->empty_type) (fhandle);
       return debug_write_type (info, fns, fhandle, *type->u.kindirect->slot,
 			       name);

-- 
Alan Modra
Australia Development Lab, IBM