From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pj1-x1034.google.com (mail-pj1-x1034.google.com [IPv6:2607:f8b0:4864:20::1034]) by sourceware.org (Postfix) with ESMTPS id 679E73851C04 for ; Fri, 4 Sep 2020 13:34:10 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 679E73851C04 Received: by mail-pj1-x1034.google.com with SMTP id n3so5213458pjq.1 for ; Fri, 04 Sep 2020 06:34:10 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=gdX2x1v2NQ/n9+drblGUzfmUT1luUFijJBkxzoId1yI=; b=IT4gX2iWUG5grK3RLLCl/A3niDQHJtxoHdUDp2B9KDFP6h1o/RC8mKnBNNOJoGDD7d Hmz1hm9g2X3aoLamU5mjmTSpzdMYnyQ7ab8ln1dswZnSgRsQ1aaxK5UJqKT5Ddd5d1+n iGr8Dxgj36EZwwX80FWcjkPUaLtnWRQzSSAqriyYbbtrQUw4WDp7Nd5WBYV7muHp8+jt x65JBkc5DhR1bu8rzJMO9Rv0JC4aSOcrXDtUg0QUF91qYGRvTXe2J4upFa61gjFRt+Sd 3xQ9PaMYo086DM2ShpkLveMU9JbaUC08Q3z6xKc+RAkGiUd6APLbGhaDc9wEB45No3M/ raTA== X-Gm-Message-State: AOAM53310LVT/2g0gkyX+4LMrcReTvUBRF14l6YydJdrYXsaCNsiMGeg R5hd4e2xdC9MuJ5YhPDMKmU= X-Google-Smtp-Source: ABdhPJyRktFqVPWB9vxEJrpZUVg0JFlvLov6o8MRCY+lNwROE1aK2e2bitaNIMqlr2Jg4IKqC/J92w== X-Received: by 2002:a17:90a:a111:: with SMTP id s17mr8230340pjp.28.1599226449304; Fri, 04 Sep 2020 06:34:09 -0700 (PDT) Received: from bubble.grove.modra.org (158.106.96.58.static.exetel.com.au. [58.96.106.158]) by smtp.gmail.com with ESMTPSA id j10sm7008723pff.171.2020.09.04.06.34.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 04 Sep 2020 06:34:08 -0700 (PDT) Received: by bubble.grove.modra.org (Postfix, from userid 1000) id 0638680BD3; Fri, 4 Sep 2020 23:04:03 +0930 (ACST) Date: Fri, 4 Sep 2020 23:04:03 +0930 From: Alan Modra To: Iain Buclaw Cc: gcc-patches@gcc.gnu.org, Ian Lance Taylor Subject: Re: ubsan: d-demangle.c:214 signed integer overflow Message-ID: <20200904133403.GV15695@bubble.grove.modra.org> References: <20200903130116.GQ15695@bubble.grove.modra.org> <1599163400.8r2ly1k30n.astroid@galago.none> <20200904005939.GR15695@bubble.grove.modra.org> <1599207109.qqwjbgoeso.astroid@galago.none> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1599207109.qqwjbgoeso.astroid@galago.none> User-Agent: Mutt/1.9.4 (2018-02-28) X-Spam-Status: No, score=-12.5 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Sep 2020 13:34:12 -0000 So this one is on top of the previously posted patch. * d-demangle.c (string_need): Take a size_t n arg, and use size_t tem. (string_append): Use size_t n. (string_appendn, string_prependn): Take a size_t n arg. (TEMPLATE_LENGTH_UNKNOWN): Define as -1UL. * d-demangle.c (dlang_number): Make "ret" an unsigned long*. Only succeed for result of [0,4294967295UL]. (dlang_decode_backref): Only succeed for result [1,MAX_LONG]. (dlang_backref): Remove now unnecessary range check. (dlang_symbol_name_p): Likewise. (dlang_lname, dlang_parse_template): Take an unsigned long len arg. (dlang_symbol_backref, dlang_identifier, dlang_parse_integer), (dlang_parse_integer, dlang_parse_string), (dlang_parse_arrayliteral, dlang_parse_assocarray), (dlang_parse_structlit, dlang_parse_tuple), (dlang_template_symbol_param, dlang_template_args): Use unsigned long variables. * testsuite/d-demangle-expected: Add new tests. diff --git a/libiberty/d-demangle.c b/libiberty/d-demangle.c index 59e6ae007a..152f620abf 100644 --- a/libiberty/d-demangle.c +++ b/libiberty/d-demangle.c @@ -62,9 +62,9 @@ typedef struct string /* Beware: these aren't required to be */ } string; static void -string_need (string *s, int n) +string_need (string *s, size_t n) { - int tem; + size_t tem; if (s->b == NULL) { @@ -75,7 +75,7 @@ string_need (string *s, int n) s->p = s->b = XNEWVEC (char, n); s->e = s->b + n; } - else if (s->e - s->p < n) + else if ((size_t) (s->e - s->p) < n) { tem = s->p - s->b; n += tem; @@ -124,14 +124,14 @@ string_setlength (string *s, int n) static void string_append (string *p, const char *s) { - int n = strlen (s); + size_t n = strlen (s); string_need (p, n); memcpy (p->p, s, n); p->p += n; } static void -string_appendn (string *p, const char *s, int n) +string_appendn (string *p, const char *s, size_t n) { if (n != 0) { @@ -142,7 +142,7 @@ string_appendn (string *p, const char *s, int n) } static void -string_prependn (string *p, const char *s, int n) +string_prependn (string *p, const char *s, size_t n) { char *q; @@ -177,7 +177,7 @@ struct dlang_info }; /* Pass as the LEN to dlang_parse_template if symbol length is not known. */ -enum { TEMPLATE_LENGTH_UNKNOWN = -1 }; +#define TEMPLATE_LENGTH_UNKNOWN (-1UL) /* Prototypes for forward referenced functions */ static const char *dlang_function_type (string *, const char *, @@ -200,15 +200,16 @@ static const char *dlang_parse_tuple (string *, const char *, struct dlang_info *); static const char *dlang_parse_template (string *, const char *, - struct dlang_info *, long); + struct dlang_info *, unsigned long); -static const char *dlang_lname (string *, const char *, long); +static const char *dlang_lname (string *, const char *, unsigned long); /* Extract the number from MANGLED, and assign the result to RET. - Return the remaining string on success or NULL on failure. */ + Return the remaining string on success or NULL on failure. + A result larger than 4294967295UL is considered a failure. */ static const char * -dlang_number (const char *mangled, long *ret) +dlang_number (const char *mangled, unsigned long *ret) { /* Return NULL if trying to extract something that isn't a digit. */ if (mangled == NULL || !ISDIGIT (*mangled)) @@ -218,17 +219,17 @@ dlang_number (const char *mangled, long *ret) while (ISDIGIT (*mangled)) { - /* Check for overflow. Yes, we return NULL here for some digits - that don't overflow "val * 10 + digit", but that doesn't - matter given the later "(long) val < 0" test. */ - if (val > (ULONG_MAX - 9) / 10) + unsigned long digit = mangled[0] - '0'; + + /* Check for overflow. */ + if (val > (4294967295UL - digit) / 10) return NULL; - val = val * 10 + mangled[0] - '0'; + val = val * 10 + digit; mangled++; } - if (*mangled == '\0' || (long) val < 0) + if (*mangled == '\0') return NULL; *ret = val; @@ -280,7 +281,8 @@ dlang_call_convention_p (const char *mangled) } /* Extract the back reference position from MANGLED, and assign the result - to RET. Return the remaining string on success or NULL on failure. */ + to RET. Return the remaining string on success or NULL on failure. + A result <= 0 is a failure. */ static const char * dlang_decode_backref (const char *mangled, long *ret) { @@ -314,6 +316,8 @@ dlang_decode_backref (const char *mangled, long *ret) if (mangled[0] >= 'a' && mangled[0] <= 'z') { val += mangled[0] - 'a'; + if ((long) val <= 0) + break; *ret = val; return mangled + 1; } @@ -344,7 +348,7 @@ dlang_backref (const char *mangled, const char **ret, struct dlang_info *info) if (mangled == NULL) return NULL; - if (refpos <= 0 || refpos > qpos - info->s) + if (refpos > qpos - info->s) return NULL; /* Set the position of the back reference. */ @@ -366,7 +370,7 @@ dlang_symbol_backref (string *decl, const char *mangled, ^ */ const char *backref; - long len; + unsigned long len; /* Get position of the back reference. */ mangled = dlang_backref (mangled, &backref, info); @@ -442,7 +446,7 @@ dlang_symbol_name_p (const char *mangled, struct dlang_info *info) return 0; mangled = dlang_decode_backref (mangled + 1, &ret); - if (mangled == NULL || ret <= 0 || ret > qref - info->s) + if (mangled == NULL || ret > qref - info->s) return 0; return ISDIGIT (qref[-ret]); @@ -992,7 +996,7 @@ dlang_type (string *decl, const char *mangled, struct dlang_info *info) static const char * dlang_identifier (string *decl, const char *mangled, struct dlang_info *info) { - long len; + unsigned long len; if (mangled == NULL || *mangled == '\0') return NULL; @@ -1010,7 +1014,7 @@ dlang_identifier (string *decl, const char *mangled, struct dlang_info *info) if (endptr == NULL || len == 0) return NULL; - if (strlen (endptr) < (size_t) len) + if (strlen (endptr) < len) return NULL; mangled = endptr; @@ -1027,7 +1031,7 @@ dlang_identifier (string *decl, const char *mangled, struct dlang_info *info) with special treatment for some magic compiler generted symbols. Return the remaining string on success or NULL on failure. */ static const char * -dlang_lname (string *decl, const char *mangled, long len) +dlang_lname (string *decl, const char *mangled, unsigned long len) { switch (len) { @@ -1126,7 +1130,7 @@ dlang_parse_integer (string *decl, const char *mangled, char type) char value[20]; int pos = sizeof(value); int width = 0; - long val; + unsigned long val; mangled = dlang_number (mangled, &val); if (mangled == NULL) @@ -1182,7 +1186,7 @@ dlang_parse_integer (string *decl, const char *mangled, char type) else if (type == 'b') { /* Parse boolean value. */ - long val; + unsigned long val; mangled = dlang_number (mangled, &val); if (mangled == NULL) @@ -1301,7 +1305,7 @@ static const char * dlang_parse_string (string *decl, const char *mangled) { char type = *mangled; - long len; + unsigned long len; mangled++; mangled = dlang_number (mangled, &len); @@ -1365,7 +1369,7 @@ dlang_parse_string (string *decl, const char *mangled) static const char * dlang_parse_arrayliteral (string *decl, const char *mangled) { - long elements; + unsigned long elements; mangled = dlang_number (mangled, &elements); if (mangled == NULL) @@ -1391,7 +1395,7 @@ dlang_parse_arrayliteral (string *decl, const char *mangled) static const char * dlang_parse_assocarray (string *decl, const char *mangled) { - long elements; + unsigned long elements; mangled = dlang_number (mangled, &elements); if (mangled == NULL) @@ -1422,7 +1426,7 @@ dlang_parse_assocarray (string *decl, const char *mangled) static const char * dlang_parse_structlit (string *decl, const char *mangled, const char *name) { - long args; + unsigned long args; mangled = dlang_number (mangled, &args); if (mangled == NULL) @@ -1649,7 +1653,7 @@ dlang_parse_qualified (string *decl, const char *mangled, static const char * dlang_parse_tuple (string *decl, const char *mangled, struct dlang_info *info) { - long elements; + unsigned long elements; mangled = dlang_number (mangled, &elements); if (mangled == NULL) @@ -1684,7 +1688,7 @@ dlang_template_symbol_param (string *decl, const char *mangled, if (*mangled == 'Q') return dlang_parse_qualified (decl, mangled, info, 0); - long len; + unsigned long len; const char *endptr = dlang_number (mangled, &len); if (endptr == NULL || len == 0) @@ -1797,12 +1801,12 @@ dlang_template_args (string *decl, const char *mangled, struct dlang_info *info) } case 'X': /* Externally mangled parameter. */ { - long len; + unsigned long len; const char *endptr; mangled++; endptr = dlang_number (mangled, &len); - if (endptr == NULL || strlen (endptr) < (size_t) len) + if (endptr == NULL || strlen (endptr) < len) return NULL; string_appendn (decl, endptr, len); @@ -1822,7 +1826,7 @@ dlang_template_args (string *decl, const char *mangled, struct dlang_info *info) Returns the remaining signature on success or NULL on failure. */ static const char * dlang_parse_template (string *decl, const char *mangled, - struct dlang_info *info, long len) + struct dlang_info *info, unsigned long len) { const char *start = mangled; string args; @@ -1858,7 +1862,9 @@ dlang_parse_template (string *decl, const char *mangled, string_delete (&args); /* Check for template name length mismatch. */ - if (len != TEMPLATE_LENGTH_UNKNOWN && mangled && (mangled - start) != len) + if (len != TEMPLATE_LENGTH_UNKNOWN + && mangled + && (unsigned long) (mangled - start) != len) return NULL; return mangled; diff --git a/libiberty/testsuite/d-demangle-expected b/libiberty/testsuite/d-demangle-expected index e3f32e31d7..97bcdd5978 100644 --- a/libiberty/testsuite/d-demangle-expected +++ b/libiberty/testsuite/d-demangle-expected @@ -1140,6 +1140,14 @@ _D4test34__T3barVG3uw3_616263VG3wd3_646566Z1xi test.bar!("abc"w, "def"d).x # --format=dlang +_D4test21__T3funVwi4294967295Z3funFNaNbNiNfZv +test.fun!('\Uffffffff').fun() +# +--format=dlang +_D4test21__T3funVwi4294967296Z3funFNaNbNiNfZv +_D4test21__T3funVwi4294967296Z3funFNaNbNiNfZv +# +--format=dlang _D6plugin8generateFiiZAya plugin.generate(int, int) # -- Alan Modra Australia Development Lab, IBM