Hi Jeff, [I am sending this to your directly since you seem to be the only one reviewing these patches].
Hot on the heels of the fix for the recursion problem in demangle_const a binutils user has filed another PoC that exposes a problem in demangle_path_maybe_open_generics(): https://sourceware.org/bugzilla/show_bug.cgi?id=29312#c1 I have redirected them to file a bug report with the gcc system, but in the hopes of getting a fix in quickly I am also attaching a patch here. It just does the obvious thing of adding a recursion counter and limit to the function. Cheers Nick
diff --git a/libiberty/rust-demangle.c b/libiberty/rust-demangle.c index 36afcfae278..d6daf23af27 100644 --- a/libiberty/rust-demangle.c +++ b/libiberty/rust-demangle.c @@ -1082,6 +1082,18 @@ demangle_path_maybe_open_generics (struct rust_demangler *rdm) if (rdm->errored) return open; + if (rdm->recursion != RUST_NO_RECURSION_LIMIT) + { + ++ rdm->recursion; + if (rdm->recursion > RUST_MAX_RECURSION_COUNT) + { + /* FIXME: There ought to be a way to report + that the recursion limit has been reached. */ + rdm->errored = 1; + goto end_of_func; + } + } + if (eat (rdm, 'B')) { backref = parse_integer_62 (rdm); @@ -1107,6 +1119,11 @@ demangle_path_maybe_open_generics (struct rust_demangler *rdm) } else demangle_path (rdm, 0); + + end_of_func: + if (rdm->recursion != RUST_NO_RECURSION_LIMIT) + -- rdm->recursion; + return open; }