public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug c++/67394] New: crash due to null pointer deref in demangle_signature()
@ 2015-08-29 17:08 brian.carpenter at gmail dot com
2015-08-29 22:06 ` [Bug c++/67394] " miyuki at gcc dot gnu.org
0 siblings, 1 reply; 2+ messages in thread
From: brian.carpenter at gmail dot com @ 2015-08-29 17:08 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67394
Bug ID: 67394
Summary: crash due to null pointer deref in
demangle_signature()
Product: gcc
Version: 4.9.2
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: c++
Assignee: unassigned at gcc dot gnu.org
Reporter: brian.carpenter at gmail dot com
Target Milestone: ---
While fuzzing binutils/cxxfilt with AFL (http://lcamtuf.coredump.cx/afl/), I
discovered a crash due to a null ptr deref in demangle_signature(). This is
with GCC 4.9.2 and Debian 7 (x64).
./cxxfilt _Q.__0
Valgrind:
==4253== Invalid write of size 8
==4253== at 0x7AD3A0: register_Btype (cplus-dem.c:4319)
==4253== by 0x7AD3A0: demangle_class (cplus-dem.c:2594)
==4253== by 0x7AD3A0: demangle_signature (cplus-dem.c:1490)
==4253== by 0x7BB869: internal_cplus_demangle (cplus-dem.c:1203)
==4253== by 0x7825B2: cplus_demangle (cplus-dem.c:886)
==4253== by 0x408192: demangle_it (cxxfilt.c:62)
==4253== by 0x407618: main (cxxfilt.c:227)
==4253== Address 0x0 is not stack'd, malloc'd or (recently) free'd
==4253==
==4253==
==4253== Process terminating with default action of signal 11 (SIGSEGV)
==4253== Access not within mapped region at address 0x0
==4253== at 0x7AD3A0: register_Btype (cplus-dem.c:4319)
==4253== by 0x7AD3A0: demangle_class (cplus-dem.c:2594)
==4253== by 0x7AD3A0: demangle_signature (cplus-dem.c:1490)
==4253== by 0x7BB869: internal_cplus_demangle (cplus-dem.c:1203)
==4253== by 0x7825B2: cplus_demangle (cplus-dem.c:886)
==4253== by 0x408192: demangle_it (cxxfilt.c:62)
==4253== by 0x407618: main (cxxfilt.c:227)
==4253== If you believe this happened as a result of a stack
==4253== overflow in your program's main thread (unlikely but
==4253== possible), you can try to increase the size of the
==4253== main thread stack using the --main-stacksize= flag.
==4253== The main thread stack size used in this run was 8388608.
Segmentation fault
GDB:
Program received signal SIGSEGV, Segmentation fault.
0x00000000007ad3a0 in demangle_signature ()
(gdb) bt
#0 0x00000000007ad3a0 in demangle_signature ()
#1 0x00000000007bb86a in internal_cplus_demangle ()
#2 0x00000000007825b3 in cplus_demangle ()
#3 0x0000000000408193 in demangle_it () at cxxfilt.c:62
#4 0x0000000000407619 in main () at cxxfilt.c:227
(gdb) i R
rax 0x0 0
rbx 0x0 0
rcx 0x0 0
rdx 0x7fffffffe110 140737488347408
rsi 0x7fffffffe108 140737488347400
rdi 0x0 0
rbp 0x7fffffffe108 0x7fffffffe108
rsp 0x7fffffffdfe0 0x7fffffffdfe0
r8 0xabe000 11264000
r9 0x0 0
r10 0x20 32
r11 0x1e 30
r12 0x7fffffffe110 140737488347408
r13 0x0 0
r14 0x7fffffffe180 140737488347520
r15 0x1 1
rip 0x7ad3a0 0x7ad3a0 <demangle_signature+9248>
eflags 0x10293 [ CF AF SF IF RF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
^ permalink raw reply [flat|nested] 2+ messages in thread
* [Bug c++/67394] crash due to null pointer deref in demangle_signature()
2015-08-29 17:08 [Bug c++/67394] New: crash due to null pointer deref in demangle_signature() brian.carpenter at gmail dot com
@ 2015-08-29 22:06 ` miyuki at gcc dot gnu.org
0 siblings, 0 replies; 2+ messages in thread
From: miyuki at gcc dot gnu.org @ 2015-08-29 22:06 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67394
Mikhail Maltsev <miyuki at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |NEW
Last reconfirmed| |2015-08-29
CC| |miyuki at gcc dot gnu.org
Ever confirmed|0 |1
Known to fail| |6.0
--- Comment #1 from Mikhail Maltsev <miyuki at gcc dot gnu.org> ---
Reproduces on trunk (the bug is in pre-v3 demangler, cplus-dem.c, I did not
fuzz it). Something like this should fix it:
diff --git a/libiberty/cplus-dem.c b/libiberty/cplus-dem.c
index c68b981..7ab46dd 100644
--- a/libiberty/cplus-dem.c
+++ b/libiberty/cplus-dem.c
@@ -1237,11 +1237,13 @@ squangle_mop_up (struct work_stuff *work)
{
free ((char *) work -> btypevec);
work->btypevec = NULL;
+ work->bsize = 0;
}
if (work -> ktypevec != NULL)
{
free ((char *) work -> ktypevec);
work->ktypevec = NULL;
+ work->ksize = 0;
}
}
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2015-08-29 22:06 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-08-29 17:08 [Bug c++/67394] New: crash due to null pointer deref in demangle_signature() brian.carpenter at gmail dot com
2015-08-29 22:06 ` [Bug c++/67394] " miyuki at gcc dot gnu.org
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).