From: Nick Clifton <nickc@redhat.com>
To: Pedro Alves <palves@redhat.com>, Ian Lance Taylor <iant@google.com>
Cc: Richard Biener <richard.guenther@gmail.com>,
Jakub Jelinek <jakub@redhat.com>,
matz@gcc.gnu.org, sgayou@redhat.com, Tom Tromey <tom@tromey.com>,
GCC Patches <gcc-patches@gcc.gnu.org>,
Binutils <binutils@sourceware.org>,
Jason Merrill <jason@redhat.com>
Subject: Re: RFA/RFC: Add stack recursion limit to libiberty's demangler [v5]
Date: Tue, 04 Dec 2018 16:57:00 -0000 [thread overview]
Message-ID: <c7c959ca-b8bf-bd3e-a65d-bb274a3118d3@redhat.com> (raw)
In-Reply-To: <57d33aa7-4e37-a09c-4bdc-974b5f654d33@redhat.com>
[-- Attachment #1: Type: text/plain, Size: 426 bytes --]
Hi Pedro,
> The issue pointed out by
>
> https://gcc.gnu.org/ml/gcc-patches/2018-11/msg02592.html
>
> is still present in this version.
Doh! Yes I meant to fix that one too, but forgot.
> Also, noticed a typo here:
>
>> +/* If DMGL_NO_RECURE_LIMIT is not enabled, then this is the value used as
>
> Typo: "RECURE"
Oops - thanks.
OK, revised (v5) patch attached. Is this version acceptable to all ?
Cheers
Nick
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: libiberty-demangler-recursion-limit.5.patch --]
[-- Type: text/x-patch; name="libiberty-demangler-recursion-limit.5.patch", Size: 7115 bytes --]
Index: include/demangle.h
===================================================================
--- include/demangle.h (revision 266771)
+++ include/demangle.h (working copy)
@@ -68,6 +68,17 @@
/* If none of these are set, use 'current_demangling_style' as the default. */
#define DMGL_STYLE_MASK (DMGL_AUTO|DMGL_GNU|DMGL_LUCID|DMGL_ARM|DMGL_HP|DMGL_EDG|DMGL_GNU_V3|DMGL_JAVA|DMGL_GNAT|DMGL_DLANG|DMGL_RUST)
+/* Disable a limit on the depth of recursion in mangled strings.
+ Note if this limit is disabled then stack exhaustion is possible when
+ demangling pathologically complicated strings. Bug reports about stack
+ exhaustion when the option is enabled will be rejected. */
+#define DMGL_NO_RECURSE_LIMIT (1 << 18)
+
+/* If DMGL_NO_RECURSE_LIMIT is not enabled, then this is the value used as
+ the maximum depth of recursion allowed. It should be enough for any
+ real-world mangled name. */
+#define DEMANGLE_RECURSION_LIMIT 1024
+
/* Enumeration of possible demangling styles.
Lucid and ARM styles are still kept logically distinct, even though
Index: libiberty/cp-demangle.c
===================================================================
--- libiberty/cp-demangle.c (revision 266771)
+++ libiberty/cp-demangle.c (working copy)
@@ -2852,21 +2852,35 @@
static struct demangle_component *
d_function_type (struct d_info *di)
{
- struct demangle_component *ret;
+ struct demangle_component *ret = NULL;
- if (! d_check_char (di, 'F'))
- return NULL;
- if (d_peek_char (di) == 'Y')
+ if ((di->options & DMGL_NO_RECURSE_LIMIT) == 0)
{
- /* Function has C linkage. We don't print this information.
- FIXME: We should print it in verbose mode. */
- d_advance (di, 1);
+ if (di->recursion_level > DEMANGLE_RECURSION_LIMIT)
+ /* FIXME: There ought to be a way to report
+ that the recursion limit has been reached. */
+ return NULL;
+
+ di->recursion_level ++;
}
- ret = d_bare_function_type (di, 1);
- ret = d_ref_qualifier (di, ret);
- if (! d_check_char (di, 'E'))
- return NULL;
+ if (d_check_char (di, 'F'))
+ {
+ if (d_peek_char (di) == 'Y')
+ {
+ /* Function has C linkage. We don't print this information.
+ FIXME: We should print it in verbose mode. */
+ d_advance (di, 1);
+ }
+ ret = d_bare_function_type (di, 1);
+ ret = d_ref_qualifier (di, ret);
+
+ if (! d_check_char (di, 'E'))
+ ret = NULL;
+ }
+
+ if ((di->options & DMGL_NO_RECURSE_LIMIT) == 0)
+ di->recursion_level --;
return ret;
}
@@ -6203,6 +6217,7 @@
di->expansion = 0;
di->is_expression = 0;
di->is_conversion = 0;
+ di->recursion_level = 0;
}
/* Internal implementation for the demangler. If MANGLED is a g++ v3 ABI
@@ -6242,6 +6257,20 @@
cplus_demangle_init_info (mangled, options, strlen (mangled), &di);
+ /* PR 87675 - Check for a mangled string that is so long
+ that we do not have enough stack space to demangle it. */
+ if (((options & DMGL_NO_RECURSE_LIMIT) == 0)
+ /* This check is a bit arbitrary, since what we really want to do is to
+ compare the sizes of the di.comps and di.subs arrays against the
+ amount of stack space remaining. But there is no portable way to do
+ this, so instead we use the recursion limit as a guide to the maximum
+ size of the arrays. */
+ && (unsigned long) di.num_comps > DEMANGLE_RECURSION_LIMIT)
+ {
+ /* FIXME: We need a way to indicate that a stack limit has been reached. */
+ return 0;
+ }
+
{
#ifdef CP_DYNAMIC_ARRAYS
__extension__ struct demangle_component comps[di.num_comps];
Index: libiberty/cp-demangle.h
===================================================================
--- libiberty/cp-demangle.h (revision 266771)
+++ libiberty/cp-demangle.h (working copy)
@@ -122,6 +122,9 @@
/* Non-zero if we are parsing the type operand of a conversion
operator, but not when in an expression. */
int is_conversion;
+ /* If DMGL_NO_RECURSE_LIMIT is not active then this is set to
+ the current recursion level. */
+ unsigned int recursion_level;
};
/* To avoid running past the ending '\0', don't:
Index: libiberty/cplus-dem.c
===================================================================
--- libiberty/cplus-dem.c (revision 266771)
+++ libiberty/cplus-dem.c (working copy)
@@ -146,6 +146,7 @@
int *proctypevec; /* Indices of currently processed remembered typevecs. */
int proctypevec_size;
int nproctypes;
+ unsigned int recursion_level;
};
#define PRINT_ANSI_QUALIFIERS (work -> options & DMGL_ANSI)
@@ -1292,6 +1293,7 @@
free ((char *) work -> btypevec);
work->btypevec = NULL;
work->bsize = 0;
+ work->numb = 0;
}
if (work -> ktypevec != NULL)
{
@@ -1298,6 +1300,7 @@
free ((char *) work -> ktypevec);
work->ktypevec = NULL;
work->ksize = 0;
+ work->numk = 0;
}
}
@@ -1331,8 +1334,15 @@
for (i = 0; i < from->numk; i++)
{
- int len = strlen (from->ktypevec[i]) + 1;
+ int len;
+ if (from->ktypevec[i] == NULL)
+ {
+ to->ktypevec[i] = NULL;
+ continue;
+ }
+
+ len = strlen (from->ktypevec[i]) + 1;
to->ktypevec[i] = XNEWVEC (char, len);
memcpy (to->ktypevec[i], from->ktypevec[i], len);
}
@@ -1342,8 +1352,15 @@
for (i = 0; i < from->numb; i++)
{
- int len = strlen (from->btypevec[i]) + 1;
+ int len;
+ if (from->btypevec[i] == NULL)
+ {
+ to->btypevec[i] = NULL;
+ continue;
+ }
+
+ len = strlen (from->btypevec[i]) + 1;
to->btypevec[i] = XNEWVEC (char , len);
memcpy (to->btypevec[i], from->btypevec[i], len);
}
@@ -1401,6 +1418,7 @@
free ((char*) work->tmpl_argvec);
work->tmpl_argvec = NULL;
+ work->ntmpl_args = 0;
}
if (work->previous_argument)
{
@@ -4478,6 +4496,7 @@
}
/* Lose all the info related to B and K type codes. */
+
static void
forget_B_and_K_types (struct work_stuff *work)
{
@@ -4503,6 +4522,7 @@
}
}
}
+
/* Forget the remembered types, but not the type vector itself. */
static void
@@ -4697,6 +4717,16 @@
int result;
int saved_nrepeats;
+ if ((work->options & DMGL_NO_RECURSE_LIMIT) == 0)
+ {
+ if (work->recursion_level > DEMANGLE_RECURSION_LIMIT)
+ /* FIXME: There ought to be a way to report
+ that the recursion limit has been reached. */
+ return 0;
+
+ work->recursion_level ++;
+ }
+
/* The G++ name-mangling algorithm does not remember types on nested
argument lists, unless -fsquangling is used, and in that case the
type vector updated by remember_type is not used. So, we turn
@@ -4723,6 +4753,9 @@
--work->forgetting_types;
work->nrepeats = saved_nrepeats;
+ if ((work->options & DMGL_NO_RECURSE_LIMIT) == 0)
+ --work->recursion_level;
+
return result;
}
next prev parent reply other threads:[~2018-12-04 16:57 UTC|newest]
Thread overview: 55+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-11-30 8:38 RFA/RFC: Add stack recursion limit to libiberty's demangler Nick Clifton
2018-11-30 8:42 ` Jakub Jelinek
2018-11-30 10:27 ` Nick Clifton
2018-11-30 13:46 ` Michael Matz
2018-11-30 14:57 ` Ian Lance Taylor
2018-12-02 0:49 ` Cary Coutant
2018-12-03 14:53 ` Nick Clifton
2018-12-03 22:00 ` Joseph Myers
2018-11-30 13:56 ` Ian Lance Taylor
2018-11-30 14:03 ` Jakub Jelinek
2018-11-30 17:41 ` RFA/RFC: Add stack recursion limit to libiberty's demangler [v3] Nick Clifton
2018-11-30 17:49 ` Jakub Jelinek
2018-11-30 18:19 ` Pedro Alves
2018-12-03 10:28 ` Richard Biener
2018-12-03 14:45 ` Nick Clifton
2018-12-03 18:49 ` Ian Lance Taylor via gcc-patches
2018-12-04 14:00 ` RFA/RFC: Add stack recursion limit to libiberty's demangler [v4] Nick Clifton
2018-12-04 15:02 ` Pedro Alves
2018-12-04 16:57 ` Nick Clifton [this message]
2018-12-04 17:08 ` RFA/RFC: Add stack recursion limit to libiberty's demangler [v5] Pedro Alves
2018-12-06 11:12 ` Nick Clifton
2018-12-06 18:04 ` Ian Lance Taylor via gcc-patches
2018-12-07 16:17 ` H.J. Lu
2018-12-07 16:25 ` [PATCH] Set DEMANGLE_RECURSION_LIMIT to 1536 H.J. Lu
2018-12-10 14:52 ` Michael Matz
2018-12-10 15:10 ` Jakub Jelinek
2018-12-10 15:34 ` Jason Merrill
2018-12-11 0:33 ` Jeff Law
2018-12-11 6:58 ` Jakub Jelinek
2018-12-11 11:05 ` Pedro Alves
2018-12-11 14:26 ` Ian Lance Taylor via gcc-patches
2018-12-11 15:07 ` Pedro Alves
2018-12-11 10:34 ` Pedro Alves
2018-12-10 15:12 ` Nick Clifton
2018-12-10 15:18 ` Jakub Jelinek
2018-12-10 15:26 ` Nick Clifton
2018-12-10 15:35 ` Jakub Jelinek
2018-12-10 18:20 ` Ian Lance Taylor via gcc-patches
2018-12-10 18:55 ` Jakub Jelinek
2018-12-10 23:47 ` Jason Merrill
2018-12-10 15:18 ` David Malcolm
2018-12-10 15:31 ` Nick Clifton
2018-12-06 16:14 ` RFA/RFC: Add stack recursion limit to libiberty's demangler [v5] Jason Merrill
2018-12-06 21:22 ` RFC: libiberty PATCH to disable demangling of ancient mangling schemes Jason Merrill
2018-12-07 10:27 ` Nick Clifton
2018-12-07 10:40 ` Jakub Jelinek
2018-12-07 16:11 ` Pedro Alves
2018-12-07 17:49 ` Tom Tromey
2018-12-07 21:00 ` Jason Merrill
2018-12-14 22:39 ` Jason Merrill
2018-12-16 4:50 ` Simon Marchi
2018-12-07 16:28 ` Nick Clifton
2018-12-07 11:37 ` Richard Biener
2018-12-07 15:49 ` Jason Merrill
2018-12-10 1:04 ` Eric Gallager
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c7c959ca-b8bf-bd3e-a65d-bb274a3118d3@redhat.com \
--to=nickc@redhat.com \
--cc=binutils@sourceware.org \
--cc=gcc-patches@gcc.gnu.org \
--cc=iant@google.com \
--cc=jakub@redhat.com \
--cc=jason@redhat.com \
--cc=matz@gcc.gnu.org \
--cc=palves@redhat.com \
--cc=richard.guenther@gmail.com \
--cc=sgayou@redhat.com \
--cc=tom@tromey.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).