[PATCH] cplus-demangler, free resource after a failed call to gnu_special.

[Andrew Burgess <aburgess@broadcom.com>]

Fixes issue:
  https://sourceware.org/bugzilla/show_bug.cgi?id=16817

A call to gnu_special within internal_cplus_demangle could cause memory
resources to be allocated, even if the demangle eventually fails.  The
following call into demangle_prefix will then be passed some partially
initialised state.

I've only tested this against the libiberty "make check" and against gdb on
x86-64 linux.

I don't have write access for gcc svn, but Broadcom does have a copyright
assignment in place for gcc, so if this patch is approved, could someone
apply it please.

Thanks,
Andrew



libiberty/ChangeLog

	* cplus-dmem.c (internal_cplus_demangle): Free any resources
	allocated by possible previous call to gnu_special.
	(squangle_mop_up): Reset pointers to NULL after calling free.
	* testsuite/demangle-expected: New test case.
---
 libiberty/cplus-dem.c                 | 7 +++++++
 libiberty/testsuite/demangle-expected | 5 +++++
 2 files changed, 12 insertions(+)

diff --git a/libiberty/cplus-dem.c b/libiberty/cplus-dem.c
index e948487..1c41c6f 100644
--- a/libiberty/cplus-dem.c
+++ b/libiberty/cplus-dem.c
@@ -1175,6 +1175,11 @@ internal_cplus_demangle (struct work_stuff *work, const char *mangled)
       if ((AUTO_DEMANGLING || GNU_DEMANGLING))
 	{
 	  success = gnu_special (work, &mangled, &decl);
+          if (!success)
+            {
+              delete_work_stuff (work);
+              string_delete (&decl);
+            }
 	}
       if (!success)
 	{
@@ -1218,10 +1223,12 @@ squangle_mop_up (struct work_stuff *work)
   if (work -> btypevec != NULL)
     {
       free ((char *) work -> btypevec);
+      work->btypevec = NULL;
     }
   if (work -> ktypevec != NULL)
     {
       free ((char *) work -> ktypevec);
+      work->ktypevec = NULL;
     }
 }
 
diff --git a/libiberty/testsuite/demangle-expected b/libiberty/testsuite/demangle-expected
index 453f9a3..864ee7e 100644
--- a/libiberty/testsuite/demangle-expected
+++ b/libiberty/testsuite/demangle-expected
@@ -4343,3 +4343,8 @@ cereal::detail::InputBindingMap<cereal::JSONInputArchive>::Serializers cereal::p
 --format=gnu-v3
 _ZNSt9_Any_data9_M_accessIPZ4postISt8functionIFvvEEEvOT_EUlvE_EERS5_v
 void post<std::function<void ()> >(std::function<void ()>&&)::{lambda()#1}*& std::_Any_data::_M_access<void post<std::function<void ()> >(void post<std::function<void ()> >(std::function<void ()>&&)::{lambda()#1}*&&)::{lambda()#1}*>()
+# https://sourceware.org/bugzilla/show_bug.cgi?id=16817
+--format=auto --no-params
+_QueueNotification_QueueController__$4PPPPPPPM_A_INotice___Z
+_QueueNotification_QueueController__$4PPPPPPPM_A_INotice___Z
+_QueueNotification_QueueController__$4PPPPPPPM_A_INotice___Z
-- 
1.8.1.3