Fixes issue:
https://sourceware.org/bugzilla/show_bug.cgi?id=16817
A call to gnu_special within internal_cplus_demangle could cause memory
resources to be allocated, even if the demangle eventually fails. The
following call into demangle_prefix will then be passed some partially
initialised state.
I've only tested this against the libiberty "make check" and against gdb on
x86-64 linux.
I don't have write access for gcc svn, but Broadcom does have a copyright
assignment in place for gcc, so if this patch is approved, could someone
apply it please.
Thanks,
Andrew
libiberty/ChangeLog
* cplus-dmem.c (internal_cplus_demangle): Free any resources
allocated by possible previous call to gnu_special.
(squangle_mop_up): Reset pointers to NULL after calling free.
* testsuite/demangle-expected: New test case.
---
libiberty/cplus-dem.c | 7 +++++++
libiberty/testsuite/demangle-expected | 5 +++++
2 files changed, 12 insertions(+)
diff --git a/libiberty/cplus-dem.c b/libiberty/cplus-dem.c
index e948487..1c41c6f 100644
--- a/libiberty/cplus-dem.c
+++ b/libiberty/cplus-dem.c
@@ -1175,6 +1175,11 @@ internal_cplus_demangle (struct work_stuff *work, const
char *mangled)
if ((AUTO_DEMANGLING || GNU_DEMANGLING))
{
success = gnu_special (work, &mangled, &decl);
+ if (!success)
+ {
+ delete_work_stuff (work);
+ string_delete (&decl);
+ }
}
if (!success)
{
@@ -1218,10 +1223,12 @@ squangle_mop_up (struct work_stuff *work)
if (work -> btypevec != NULL)
{
free ((char *) work -> btypevec);
+ work->btypevec = NULL;
}
if (work -> ktypevec != NULL)
{
free ((char *) work -> ktypevec);
+ work->ktypevec = NULL;
}
}
diff --git a/libiberty/testsuite/demangle-expected
b/libiberty/testsuite/demangle-expected
index 453f9a3..864ee7e 100644
--- a/libiberty/testsuite/demangle-expected
+++ b/libiberty/testsuite/demangle-expected
@@ -4343,3 +4343,8 @@
cereal::detail::InputBindingMap<cereal::JSONInputArchive>::Serializers cereal::p
--format=gnu-v3
_ZNSt9_Any_data9_M_accessIPZ4postISt8functionIFvvEEEvOT_EUlvE_EERS5_v
void post<std::function<void ()> >(std::function<void ()>&&)::{lambda()#1}*&
std::_Any_data::_M_access<void post<std::function<void ()> >(void
post<std::function<void ()> >(std::function<void
()>&&)::{lambda()#1}*&&)::{lambda()#1}*>()
+# https://sourceware.org/bugzilla/show_bug.cgi?id=16817
+--format=auto --no-params
+_QueueNotification_QueueController__$4PPPPPPPM_A_INotice___Z
+_QueueNotification_QueueController__$4PPPPPPPM_A_INotice___Z
+_QueueNotification_QueueController__$4PPPPPPPM_A_INotice___Z
--
1.8.1.3
