[Bug demangler/114830] New: c++filt stack overflows in rust demangler

[Bug demangler/114830] New: c++filt stack overflows in rust demangler

[amodra at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114830

            Bug ID: 114830
           Summary: c++filt stack overflows in rust demangler
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: demangler
          Assignee: unassigned at gcc dot gnu.org
          Reporter: amodra at gmail dot com
  Target Milestone: ---

From zhougeng@mail.zgclab.edu.cn and wangdw@mail.zgclab.edu.cn:

Hi, we found several crashes in c++filt(Binutils 2.42), which is the latest
version.

In detail, it contains 12 stack-buffer-overflow triggering methods.


To assist in diagnosing and resolving these issues, we have attached the POC
files along with the gdb/asan logs.


Environment:

Linux 4f6b99b5cf37 6.2.0-35-generic #35~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Fri
Oct  6 10:23:26 UTC 2 x86_64 x86_64 x86_64 GNU/Linux


Credit by: Wang Dawei and Zhou Geng, from Zhongguancun Laboratory.


Thanks for your time and attention to these matters.


Best regards,

Zhou Geng

[Bug demangler/114830] c++filt stack overflows in rust demangler

[amodra at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114830

--- Comment #1 from Alan Modra <amodra at gmail dot com> ---
Created attachment 58020
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=58020&action=edit
asan report summary

[Bug demangler/114830] c++filt stack overflows in rust demangler

[amodra at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114830

--- Comment #2 from Alan Modra <amodra at gmail dot com> ---
Created attachment 58021
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=58021&action=edit
c++filt crash binaries

[Bug demangler/114830] c++filt stack overflows in rust demangler

[xry111 at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114830

Xi Ruoyao <xry111 at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |xry111 at gcc dot gnu.org

--- Comment #3 from Xi Ruoyao <xry111 at gcc dot gnu.org> ---
There was a GSoC project making the demangler non recursive in 2021, but it
unfortunately failed.  So with a recursive demangler this thing just happens...