[Bug other/99763] New: c++filt crashes when demangling

[Bug other/99763] New: c++filt crashes when demangling

[bajinsheng at outlook dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99763

            Bug ID: 99763
           Summary: c++filt crashes when demangling
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: other
          Assignee: unassigned at gcc dot gnu.org
          Reporter: bajinsheng at outlook dot com
  Target Milestone: ---

the payload to trigger the crash

The bug is about segment fault, which may be caused by endless loop.

Source code repository:
git://sourceware.org/git/binutils-gdb.git

commit:
12af5ebd820425e8ad843a1dac687a2fffc4a2e3

Date:   
Tue Mar 23 00:00:07 2021 +0000

Compiler:
Clang-12

OS:
Ubuntu 16.04.7 LTS


The call stack of the bug:
#0  0x00000000004beff1 in demangle_path (rdm=rdm@entry=0x7ffe5ead2850,
in_value=in_value@entry=1)
    at ./rust-demangle.c:664
#1  0x00000000004bf4d8 in demangle_path (rdm=rdm@entry=0x7ffe5ead2850,
in_value=in_value@entry=1)
    at ./rust-demangle.c:774
………..
#52364 0x00000000004bf4d8 in demangle_path (rdm=rdm@entry=0x7ffe5ead2850,
in_value=in_value@entry=1)
    at ./rust-demangle.c:774
#52365 0x00000000004bf4d8 in demangle_path (rdm=rdm@entry=0x7ffe5ead2850,
in_value=in_value@entry=1)
    at ./rust-demangle.c:774
#52366 0x00000000004be5f0 in rust_demangle_callback (mangled=<optimized out>,
options=267, 
    callback=<optimized out>, opaque=0x7ffe5ead28d0) at ./rust-demangle.c:1400
#52367 0x00000000004bf8d2 in rust_demangle (mangled=0x7ffe5ead2850 "\302sq",
options=1)
    at ./rust-demangle.c:1511
#52368 0x00000000004a4a0d in cplus_demangle (mangled=0x7173c0 <main.mbuffer>
"_RB_R", options=267)
    at ./cplus-dem.c:166


I upload the payload to reproduce the bug:
cat payload | ./c++filt

[Bug other/99763] c++filt crashes when demangling

[bajinsheng at outlook dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99763

--- Comment #1 from Ba Jinsheng <bajinsheng at outlook dot com> ---
*** Bug 99762 has been marked as a duplicate of this bug. ***

[Bug other/99763] c++filt crashes when demangling

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99763

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2021-03-25
                 CC|                            |marxin at gcc dot gnu.org
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |WAITING

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
We likely miss the payload, right?

[Bug other/99763] c++filt crashes when demangling

[bajinsheng at outlook dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99763

--- Comment #3 from Ba Jinsheng <bajinsheng at outlook dot com> ---
Created attachment 50471
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=50471&action=edit
the payload to trigger the crash

[Bug other/99763] c++filt crashes when demangling

[bajinsheng at outlook dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99763

--- Comment #4 from Ba Jinsheng <bajinsheng at outlook dot com> ---
(In reply to Martin Liška from comment #2)
> We likely miss the payload, right?

Uploaded

[Bug other/99763] c++filt crashes when demangling

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99763

--- Comment #5 from Martin Liška <marxin at gcc dot gnu.org> ---
(In reply to Ba Jinsheng from comment #3)
> Created attachment 50471 [details]
> the payload to trigger the crash

Is it a valid symbol name? How did you come up with the name?

[Bug other/99763] c++filt crashes when demangling

[bajinsheng at outlook dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99763

--- Comment #6 from Ba Jinsheng <bajinsheng at outlook dot com> ---
(In reply to Martin Liška from comment #5)
> (In reply to Ba Jinsheng from comment #3)
> > Created attachment 50471 [details]
> > the payload to trigger the crash
> 
> Is it a valid symbol name? How did you come up with the name?

Should be not.
I got this payload by fuzzing.

[Bug other/99763] c++filt crashes when demangling

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99763

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ice-on-invalid-code

--- Comment #7 from Martin Liška <marxin at gcc dot gnu.org> ---
> I got this payload by fuzzing.

I see. It's unlikely we'll fix such cases, the name is complete garbage.

[Bug other/99763] c++filt crashes when demangling

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99763

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |NEW

[Bug other/99763] c++filt crashes when demangling

[bajinsheng at outlook dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99763

--- Comment #8 from Ba Jinsheng <bajinsheng at outlook dot com> ---
(In reply to Martin Liška from comment #7)
> > I got this payload by fuzzing.
> 
> I see. It's unlikely we'll fix such cases, the name is complete garbage.

Even it is an invalid symbol, the c++filt will crash. Shouldn't we handle these
exceptions?

[Bug demangler/99763] c++filt crashes when demangling

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99763

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |DUPLICATE
             Status|NEW                         |RESOLVED

--- Comment #9 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Dup of bug 98886.

*** This bug has been marked as a duplicate of bug 98886 ***