From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
 id 2E6143836C6A; Mon, 22 Feb 2021 03:04:22 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 2E6143836C6A
From: "zyt1024 at bupt dot edu.cn" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c++/99188] New: cxxfilt may exist a uaf
Date: Mon, 22 Feb 2021 03:04:22 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c++
X-Bugzilla-Version: unknown
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: zyt1024 at bupt dot edu.cn
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status
 bug_severity priority component assigned_to reporter target_milestone
Message-ID: <bug-99188-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: gcc-bugs@gcc.gnu.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Gcc-bugs mailing list <gcc-bugs.gcc.gnu.org>
List-Unsubscribe: <https://gcc.gnu.org/mailman/options/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=unsubscribe>
List-Archive: <https://gcc.gnu.org/pipermail/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-request@gcc.gnu.org?subject=help>
List-Subscribe: <https://gcc.gnu.org/mailman/listinfo/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=subscribe>
X-List-Received-Date: Mon, 22 Feb 2021 03:04:22 -0000

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D99188

            Bug ID: 99188
           Summary: cxxfilt may exist a uaf
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zyt1024 at bupt dot edu.cn
  Target Milestone: ---

In the version 2.26 of cxxfilt, Valgrind reports an invalid write of size.

# valgrind ./cxxfilt `cat
cxxfilt_12.29-12.30-24h-run3/error_level/level-2-double-54-g165.txt`
=3D=3D23618=3D=3D Memcheck, a memory error detector
=3D=3D23618=3D=3D Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward =
et al.
=3D=3D23618=3D=3D Using Valgrind-3.16.1 and LibVEX; rerun with -h for copyr=
ight info
=3D=3D23618=3D=3D Command: ./cxxfilt $_Q9AEKm__RQ3______xewx_x6_$$[G_O2_2C_=
_:
=3D=3D23618=3D=3D
=3D=3D23618=3D=3D Invalid write of size 4
=3D=3D23618=3D=3D    at 0x813A8E5: register_Btype (cplus-dem.c:4319)
=3D=3D23618=3D=3D    by 0x8138B02: demangle_qualified (cplus-dem.c:3287)
=3D=3D23618=3D=3D    by 0x8139739: do_type (cplus-dem.c:3771)
=3D=3D23618=3D=3D    by 0x813A5B4: do_arg (cplus-dem.c:4231)
=3D=3D23618=3D=3D    by 0x813ADA9: demangle_args (cplus-dem.c:4514)
=3D=3D23618=3D=3D    by 0x8135A90: demangle_signature (cplus-dem.c:1642)
=3D=3D23618=3D=3D    by 0x8134D07: internal_cplus_demangle (cplus-dem.c:120=
3)
=3D=3D23618=3D=3D    by 0x8134466: cplus_demangle (cplus-dem.c:886)
=3D=3D23618=3D=3D    by 0x8049A23: demangle_it (cxxfilt.c:62)
=3D=3D23618=3D=3D    by 0x8049E21: main (cxxfilt.c:227)
=3D=3D23618=3D=3D  Address 0x0 is not stack'd, malloc'd or (recently) free'd
=3D=3D23618=3D=3D
=3D=3D23618=3D=3D
..=