public inbox for gcc-cvs@sourceware.org
help / color / mirror / Atom feed
From: Nick Clifton <nickc@gcc.gnu.org>
To: gcc-cvs@gcc.gnu.org
Subject: [gcc r13-1452] Prevent another potential stack overflow issue when demangling a maliciouslt mangled Rust name.
Date: Mon,  4 Jul 2022 10:06:43 +0000 (GMT)	[thread overview]
Message-ID: <20220704100643.321B23858C52@sourceware.org> (raw)

https://gcc.gnu.org/g:1a770b01ef415e114164b6151d1e55acdee09371

commit r13-1452-g1a770b01ef415e114164b6151d1e55acdee09371
Author: Nick Clifton <nickc@redhat.com>
Date:   Mon Jul 4 11:05:03 2022 +0100

    Prevent another potential stack overflow issue when demangling a maliciouslt mangled Rust name.
    
    libiberty/
            * rust-demangle.c (demangle_path_maybe_open_generics): Add
            recursion limit.

Diff:
---
 libiberty/rust-demangle.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/libiberty/rust-demangle.c b/libiberty/rust-demangle.c
index 36afcfae278..d6daf23af27 100644
--- a/libiberty/rust-demangle.c
+++ b/libiberty/rust-demangle.c
@@ -1082,6 +1082,18 @@ demangle_path_maybe_open_generics (struct rust_demangler *rdm)
   if (rdm->errored)
     return open;
 
+  if (rdm->recursion != RUST_NO_RECURSION_LIMIT)
+    {
+      ++ rdm->recursion;
+      if (rdm->recursion > RUST_MAX_RECURSION_COUNT)
+	{
+	  /* FIXME: There ought to be a way to report
+	     that the recursion limit has been reached.  */
+	  rdm->errored = 1;
+	  goto end_of_func;
+	}
+    }
+
   if (eat (rdm, 'B'))
     {
       backref = parse_integer_62 (rdm);
@@ -1107,6 +1119,11 @@ demangle_path_maybe_open_generics (struct rust_demangler *rdm)
     }
   else
     demangle_path (rdm, 0);
+
+ end_of_func:
+  if (rdm->recursion != RUST_NO_RECURSION_LIMIT)
+    -- rdm->recursion;
+
   return open;
 }


                 reply	other threads:[~2022-07-04 10:06 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220704100643.321B23858C52@sourceware.org \
    --to=nickc@gcc.gnu.org \
    --cc=gcc-cvs@gcc.gnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).