[Bug c++/87602] Integer Overflow in cplus-dem.c in c++filt in bintuils which leads to Undefined-behavior(OOM in this POC)

[wcventure at 126 dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=87602

Cheng Wen <wcventure at 126 dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|Integer Overflow in         |Integer Overflow in
                   |cplus-dem.c in c++filt in   |cplus-dem.c in c++filt in
                   |bintuils                    |bintuils which leads to
                   |                            |Undefined-behavior(OOM in
                   |                            |this POC)

--- Comment #1 from Cheng Wen <wcventure at 126 dot com> ---
In cplus-dem.c:3597
   n *= 10;
   n += *p - '0';
   p++;
This testcase will set n = 766666666. 766666666 * 10 cannot be represented in
type 'int', which make n have a Integer overflow problem. This problem leads to
undefined-behavior.


I will show you the debug process as follow:

> $ gdb --args ./c++filt _rttt4tttt6__H7666666666666666666_
> (gdb) start
> Temporary breakpoint 1 at 0x4ea9a6: file cxxfilt.c, line 172.
> Starting program: /build/bin/c++filt _rttt4tttt6__H7666666666666666666__c
> [Thread debugging using libthread_db enabled]
> Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
> Temporary breakpoint 1, main (argc=2, argv=0x7fffffffdff8) at cxxfilt.c:172
> 172     {
> (gdb) b cplus-dem.c:3597
> Breakpoint 2 at 0x20171b4: file ./cplus-dem.c, line 3597.
> (gdb) c
> Continuing.
> Breakpoint 2, get_count (type=<optimized out>, count=<optimized out>) at 
> ./cplus-dem.c:3597
> 3597                  n *= 10;
> (gdb) n
> cplus-dem.c:3597:10: runtime error: signed integer overflow: 766666666 * 10 
> cannot be represented in type 'int'
> SUMMARY: AddressSanitizer: undefined-behavior cplus-dem.c:3597:10 in
> 3598                  n += *p - '0';
> (gdb) n
> 3599                  p++;