https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104185
Bug ID: 104185
Summary: Stack Overflow in str_buf_append():
rust-demangle.c:1493 in cxxfilt
Product: gcc
Version: unknown
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: demangler
Assignee: unassigned at gcc dot gnu.org
Reporter: sanjayr at ymail dot com
Target Milestone: ---
Created attachment 52267
--> https://gcc.gnu.org/bugzilla/attachment.cgi?id=52267&action=edit
PoV input for the above mentioned crash.
Hello,
While evaluating our new fuzzer on cxxfilt (binutils 2.37), we found a stack
overflow in str_buf_append() of libiberty/rust-demangle.c:1493. This function
calls memcpy, which probably copies more data to the destination that it can
hold.
Commit id (of github repo of binutils-gdb/libiberty/rust-demangle.c):
1657026ccd
commandline: cxxfilt < input_file (PoV)
ASan enabled binary execution output:
============================================
sanitizer: ASAN
error class: stack-overflow
location: __asan_memcpy in
/home/xyzz/build/llvm_tools/llvm-11.0.0.src/projects/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3
backtrace:
#0 4c120e __asan_memcpy in
/home/xyzz/build/llvm_tools/llvm-11.0.0.src/projects/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3
#1 85735b str_buf_append in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:1493:3
#2 85735b str_buf_demangle_callback in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:1500:3
#3 85832e print_str in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:273:5
#4 85832e demangle_type in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:877:7
#5 853d83 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:747:7
#6 8542e4 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:774:11
#7 853e11 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:751:11
#8 8542e4 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:774:11
#9 853e11 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:751:11
#10 8542e4 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:774:11
#11 853e11 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:751:11
#12 8542e4 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:774:11
#13 853e11 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:751:11
#14 8542e4 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:774:11
#15 853e11 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:751:11
#16 8542e4 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:774:11
#17 853e11 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:751:11
#18 8542e4 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:774:11
#19 853e11 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:751:11
#20 8542e4 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:774:11
#21 853e11 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:751:11
#22 8542e4 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:774:11
#23 853e11 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:751:11
#24 8542e4 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:774:11
#25 853e11 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:751:11
#26 8542e4 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:774:11
#27 853e11 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:751:11
#28 8542e4 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:774:11
#29 853e11 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:751:11
#30 8542e4 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:774:11
#31 853e11 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:751:11
#32 8542e4 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:774:11
#33 853e11 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:751:11
#34 8542e4 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:774:11
#35 853e11 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:751:11
#36 8542e4 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:774:11
#37 853e11 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:751:11
#38 8542e4 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:774:11
#39 853e11 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:751:11
#40 8542e4 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:774:11
#41 853e11 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:751:11
#42 8542e4 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:774:11
#43 853e11 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:751:11
#44 8542e4 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:774:11
#45 853e11 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:751:11
#46 8542e4 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:774:11
#47 853e11 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:751:11
#48 8542e4 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:774:11
#49 853e11 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:751:11
#50 8542e4 demangle_path in
/home/xyzz/MyProject/remote_fuzz_suite/target_src/binutils-gdb/build/libiberty/../../libiberty/rust-demangle.c:774:11
============================================
