RFA: Another Rust demangler recursion limit

RFA: Another Rust demangler recursion limit

[Nick Clifton]

[-- Attachment #1: Type: text/plain, Size: 606 bytes --]

Hi Jeff,

  [I am sending this to your directly since you seem to be the only one
  reviewing these patches].

  Hot on the heels of the fix for the recursion problem in demangle_const
  a binutils user has filed another PoC that exposes a problem in
  demangle_path_maybe_open_generics():

https://sourceware.org/bugzilla/show_bug.cgi?id=29312#c1

  I have redirected them to file a bug report with the gcc system, but in
  the hopes of getting a fix in quickly I am also attaching a patch
  here.  It just does the obvious thing of adding a recursion counter
  and limit to the function.

Cheers
  Nick


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: rust-demangle.c.patch --]
[-- Type: text/x-patch, Size: 911 bytes --]

diff --git a/libiberty/rust-demangle.c b/libiberty/rust-demangle.c
index 36afcfae278..d6daf23af27 100644
--- a/libiberty/rust-demangle.c
+++ b/libiberty/rust-demangle.c
@@ -1082,6 +1082,18 @@ demangle_path_maybe_open_generics (struct rust_demangler *rdm)
   if (rdm->errored)
     return open;
 
+  if (rdm->recursion != RUST_NO_RECURSION_LIMIT)
+    {
+      ++ rdm->recursion;
+      if (rdm->recursion > RUST_MAX_RECURSION_COUNT)
+	{
+	  /* FIXME: There ought to be a way to report
+	     that the recursion limit has been reached.  */
+	  rdm->errored = 1;
+	  goto end_of_func;
+	}
+    }
+
   if (eat (rdm, 'B'))
     {
       backref = parse_integer_62 (rdm);
@@ -1107,6 +1119,11 @@ demangle_path_maybe_open_generics (struct rust_demangler *rdm)
     }
   else
     demangle_path (rdm, 0);
+
+ end_of_func:
+  if (rdm->recursion != RUST_NO_RECURSION_LIMIT)
+    -- rdm->recursion;
+
   return open;
 }
 

Re: RFA: Another Rust demangler recursion limit

[Jeff Law]

On 7/1/2022 9:12 AM, Nick Clifton wrote:
> Hi Jeff,
>
>    [I am sending this to your directly since you seem to be the only one
>    reviewing these patches].
>
>    Hot on the heels of the fix for the recursion problem in demangle_const
>    a binutils user has filed another PoC that exposes a problem in
>    demangle_path_maybe_open_generics():
>
> https://sourceware.org/bugzilla/show_bug.cgi?id=29312#c1
>
>    I have redirected them to file a bug report with the gcc system, but in
>    the hopes of getting a fix in quickly I am also attaching a patch
>    here.  It just does the obvious thing of adding a recursion counter
>    and limit to the function.
OK.  And yes, I wish someone else was looking at this stuff.  Rust isn't 
really on my radar right now...

jeff

Re: RFA: Another Rust demangler recursion limit

[Nick Clifton]

Hi Jeff,

> OK. 

Thanks.

> And yes, I wish someone else was looking at this stuff.  Rust isn't really on my radar right now...

I have been toying with the idea of putting myself forward as a maintainer
for the libiberty sources.  I just wish that I had more free time...

Cheers
   Nick