diff mbox

Patch committed: Fix demangler crash

Message ID mcrlivlm7w5.fsf@coign.corp.google.com
State New
Headers show

Commit Message

Ian Lance Taylor July 26, 2011, 2:30 p.m. UTC
binutils PR 13030 reports a demangler crash on the symbol
    _ZSt10_ConstructI10CellBorderIS0_EEvPT_DpOT0_

As far as I can tell, this symbol is invalid.  The final T0_ refers to
template argument 1, but this zero-based index has no referent since the
template only has one parameter.  This of course suggests a compiler
bug.  CC'ing Jason because this involves template packs which I haven't
looked into very much.

I committed this patch to avoid the crash in the demangler.

Ian


2011-07-26  Ian Lance Taylor  <iant@google.com>

	* cp-demangle.c (d_print_init): Initialize pack_index field.
	(d_print_comp): Check for NULL template argument.
	* testsuite/demangle-expected: Add test case.

Comments

H.J. Lu July 26, 2011, 3:45 p.m. UTC | #1
On Tue, Jul 26, 2011 at 7:30 AM, Ian Lance Taylor <iant@google.com> wrote:
> binutils PR 13030 reports a demangler crash on the symbol
>    _ZSt10_ConstructI10CellBorderIS0_EEvPT_DpOT0_
>
> As far as I can tell, this symbol is invalid.  The final T0_ refers to
> template argument 1, but this zero-based index has no referent since the
> template only has one parameter.  This of course suggests a compiler
> bug.  CC'ing Jason because this involves template packs which I haven't
> looked into very much.
>
> I committed this patch to avoid the crash in the demangler.
>
> Ian
>
>
> 2011-07-26  Ian Lance Taylor  <iant@google.com>
>
>        * cp-demangle.c (d_print_init): Initialize pack_index field.
>        (d_print_comp): Check for NULL template argument.
>        * testsuite/demangle-expected: Add test case.
>

Could you please also check it into binutils?

Thanks.
Ian Lance Taylor July 26, 2011, 3:54 p.m. UTC | #2
"H.J. Lu" <hjl.tools@gmail.com> writes:

> On Tue, Jul 26, 2011 at 7:30 AM, Ian Lance Taylor <iant@google.com> wrote:
>> binutils PR 13030 reports a demangler crash on the symbol
>>    _ZSt10_ConstructI10CellBorderIS0_EEvPT_DpOT0_
>>
>> As far as I can tell, this symbol is invalid.  The final T0_ refers to
>> template argument 1, but this zero-based index has no referent since the
>> template only has one parameter.  This of course suggests a compiler
>> bug.  CC'ing Jason because this involves template packs which I haven't
>> looked into very much.
>>
>> I committed this patch to avoid the crash in the demangler.
>>
>> Ian
>>
>>
>> 2011-07-26  Ian Lance Taylor  <iant@google.com>
>>
>>        * cp-demangle.c (d_print_init): Initialize pack_index field.
>>        (d_print_comp): Check for NULL template argument.
>>        * testsuite/demangle-expected: Add test case.
>>
>
> Could you please also check it into binutils?

It should be brought over automatically by DJ's libiberty merge.

Ian
H.J. Lu July 26, 2011, 4:46 p.m. UTC | #3
On Tue, Jul 26, 2011 at 7:30 AM, Ian Lance Taylor <iant@google.com> wrote:
> binutils PR 13030 reports a demangler crash on the symbol
>    _ZSt10_ConstructI10CellBorderIS0_EEvPT_DpOT0_
>
> As far as I can tell, this symbol is invalid.  The final T0_ refers to
> template argument 1, but this zero-based index has no referent since the
> template only has one parameter.  This of course suggests a compiler
> bug.  CC'ing Jason because this involves template packs which I haven't
> looked into very much.
>
> I committed this patch to avoid the crash in the demangler.
>
> Ian
>
>
> 2011-07-26  Ian Lance Taylor  <iant@google.com>
>
>        * cp-demangle.c (d_print_init): Initialize pack_index field.
>        (d_print_comp): Check for NULL template argument.
>        * testsuite/demangle-expected: Add test case.
>
>
>

I think it caused:

FAIL at line 4023: unknown demangling style
_ZSt10_ConstructI10CellBorderIS0_EEvPT_DpOT0_
FAIL at line 4027: unknown demangling style yz.qrs
FAIL at line 4031: unknown demangling style oper."+"
FAIL at line 4035: unknown demangling style yz.qrs
FAIL at line 4039: unknown demangling style yz.qrs.tuv
FAIL at line 4042: unknown demangling style yz.qrs.tuv
FAIL at line 4045: unknown demangling style yz.qrs.tuv
FAIL at line 4049: unknown demangling style yz.qrs.tuv
FAIL at line 4053: unknown demangling style <x_E>
FAIL at line 4056: unknown demangling style x.m1
FAIL at line 4059: unknown demangling style x.m3
FAIL at line 4062: unknown demangling style x.y.m2
FAIL at line 4066: unknown demangling style x.y.z.r
FAIL at line 4070: unknown demangling style x.y.j
FAIL at line 4074: unknown demangling style x.m3
FAIL at line 4078: unknown demangling style p'Elab_Body
FAIL at line 4082: unknown demangling style p'Elab_Spec
FAIL at line 4086: unknown demangling style p.taskobj
FAIL at line 4090: unknown demangling style p.taskobj.f1
FAIL at line 4093: unknown demangling style prot.lock.get
FAIL at line 4096: unknown demangling style prot.lock.get
FAIL at line 4099: unknown demangling style prot.lock.get.sub
FAIL at line 4102: unknown demangling style prot.lock.set
FAIL at line 4106: unknown demangling style prot.lock.set
FAIL at line 4109: unknown demangling style prot.lock.update
FAIL at line 4113: unknown demangling style prot.lock.update
FAIL at line 4116: unknown demangling style
gnat.sockets.sockets_library_controller.Finalize
FAIL at line 4120: unknown demangling style
system.partition_interface.racw_stub_type.Adjust
FAIL at line 4123: unknown demangling style
gnat.wide_wide_string_split.slice_set'Read
FAIL at line 4126: unknown demangling style
ada.real_time.timing_events.events.list'Write
FAIL at line 4129: unknown demangling style
system.finalization_root.root_controlled'Input
FAIL at line 4133: unknown demangling style
ada.finalization.limited_controlled'Output
FAIL at line 4136: unknown demangling style ada.synchronous_task_control'Size
FAIL at line 4139: unknown demangling style
ada.real_time.timing_events.events'Alignment
FAIL at line 4144: unknown demangling style system.finalization_root.":="
FAIL at line 4149: unknown demangling style DFA
FAIL at line 4152: unknown demangling style
Psi::VariantDetail::SelectVisitorResult<VariantTest::TestVisit::test_method()::{lambda(char
const*)#2}&, VariantTest::TestVisit::test_method()::{lambda(char)#3}&,
VariantTest::TestVisit::test_method()::{lambda(Psi::None)#1}&>::type
Psi::Variant<char, char
const*>::visit<VariantTest::TestVisit::test_method()::{lambda(char const*)#2}&,
VariantTest::TestVisit::test_method()::{lambda(char)#3}&,
VariantTest::TestVisit::test_method()::{lambda(Psi::None)#1}&>((VariantTest::TestVisit::test_method()::{lambda(Psi::None)#1}&)...)

on Linux/ia32.
diff mbox

Patch

Index: testsuite/demangle-expected
===================================================================
--- testsuite/demangle-expected	(revision 176790)
+++ testsuite/demangle-expected	(working copy)
@@ -4010,6 +4010,12 @@  K<1, &S::m>::f()
 _ZN1KILi1EXadL_ZN1S1mEEEE1fEv
 K<1, &S::m>::f()
 #
+# Used to crash -- binutils PR 13030.
+--format=gnu-v3
+_ZSt10_ConstructI10CellBorderIS0_EEvPT_DpOT0_
+_ZSt10_ConstructI10CellBorderIS0_EEvPT_DpOT0_
+_ZSt10_ConstructI10CellBorderIS0_EEvPT_DpOT0_
+#
 # Ada (GNAT) tests.
 #
 # Simple test.
Index: cp-demangle.c
===================================================================
--- cp-demangle.c	(revision 176790)
+++ cp-demangle.c	(working copy)
@@ -1,5 +1,5 @@ 
 /* Demangler for g++ V3 ABI.
-   Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010
+   Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011
    Free Software Foundation, Inc.
    Written by Ian Lance Taylor <ian@wasabisystems.com>.
 
@@ -3306,6 +3306,7 @@  d_print_init (struct d_print_info *dpi, 
   dpi->last_char = '\0';
   dpi->templates = NULL;
   dpi->modifiers = NULL;
+  dpi->pack_index = 0;
   dpi->flush_count = 0;
 
   dpi->callback = callback;
@@ -3893,6 +3894,13 @@  d_print_comp (struct d_print_info *dpi, 
 	    struct demangle_component *a = d_lookup_template_argument (dpi, sub);
 	    if (a && a->type == DEMANGLE_COMPONENT_TEMPLATE_ARGLIST)
 	      a = d_index_template_argument (a, dpi->pack_index);
+
+	    if (a == NULL)
+	      {
+		d_print_error (dpi);
+		return;
+	      }
+
 	    sub = a;
 	  }