Synchronize libiberty with gcc and add --no-recruse-limit option to tools that support name demangling.

This patch addresses the multitude of bug reports about resource exhaustion
in libiberty's name demangling code.  It adds a limit to the amount of
recursion that is allowed, before an error is triggered.  It also adds a
new demangling option to disable this limit.  (The limit is enabled by
default).

	PR 87681
	PR 87675
	PR 87636
	PR 87335
libiberty * cp-demangle.h (struct d_info): Add recursion_limit field.
	* cp-demangle.c (d_function_type): If the recursion limit is
	enabled and reached, return with a failure result.
        (d_demangle_callback): If the recursion limit is enabled, check
	for a mangled string that is so long that there is not enough
	stack space for the local arrays.
        * cplus-dem.c (struct work): Add recursion_level field.
	(demangle_nested_args): If the recursion limit is enabled and
	reached, return with a failure result.

include	* demangle.h (DMGL_RECURSE_LIMIT): Define.
        (DEMANGLE_RECURSION_LIMIT): Prototype.

binutuils * addr2line.c (demangle_flags): New static variable.
        (long_options): Add --recurse-limit and --no-recurse-limit.
        (translate_address): Pass demangle_flags to bfd_demangle.
        (main): Handle --recurse-limit and --no-recurse-limit options.
        * cxxfilt.c (flags): Add DMGL_RECURSE_LIMIT.
        (long_options): Add --recurse-limit and --no-recurse-limit.
        (main): Handle new options.
        * dlltool.c (gen_def_file): Include DMGL_RECURSE_LIMIT in flags
        passed to cplus_demangle.
        * nm.c (demangle_flags): New static variable.
        (long_options): Add --recurse-limit and --no-recurse-limit.
        (main): Handle new options.
        * objdump.c (demangle_flags): New static variable.
        (usage): Add --recurse-limit and --no-recurse-limit.
        (long_options): Likewise.
        (objdump_print_symname): Pass demangle_flags to bfd_demangle.
        (disassemble_section): Likewise.
        (dump_dymbols): Likewise.
        (main): Handle new options.
        * prdbg.c (demangle_flags): New static variable.
        (tg_variable): Pass demangle_flags to demangler.
        (tg_start_function): Likewise.
        * stabs.c (demangle_flags): New static variable.
        (stab_demangle_template): Pass demangle_flags to demangler.
        (stab_demangle_v3_argtypes): Likewise.
        (stab_demangle_v3_arg): Likewise.
	* doc/binutuls.texi: Document new command line options.
	* NEWS: Mention the new feature.
        * testsuite/config/default.exp (CXXFILT): Define if not already
        defined.
        (CXXFILTFLAGS): Likewise.
        * testsuite/binutils-all/cxxfilt.exp: New file.  Runs a few
        simple tests of the cxxfilt program.
This commit is contained in:
Nick Clifton
2018-12-07 11:32:55 +00:00
parent 67bb16f345
commit af03af8f55
21 changed files with 603 additions and 145 deletions

View File

@@ -769,7 +769,9 @@ nm [@option{-A}|@option{-o}|@option{--print-file-name}] [@option{-a}|@option{--d
[@option{-s}|@option{--print-armap}] [@option{-t} @var{radix}|@option{--radix=}@var{radix}]
[@option{-u}|@option{--undefined-only}] [@option{-V}|@option{--version}]
[@option{-X 32_64}] [@option{--defined-only}] [@option{--no-demangle}]
[@option{--plugin} @var{name}] [@option{--size-sort}] [@option{--special-syms}]
[@option{--plugin} @var{name}]
[@option{--no-recurse-limit}|@option{--recurse-limit}]]
[@option{--size-sort}] [@option{--special-syms}]
[@option{--synthetic}] [@option{--with-symbol-versions}] [@option{--target=}@var{bfdname}]
[@var{objfile}@dots{}]
@c man end
@@ -939,6 +941,22 @@ for more information on demangling.
@item --no-demangle
Do not demangle low-level symbol names. This is the default.
@item --recurse-limit
@itemx --no-recurse-limit
@itemx --recursion-limit
@itemx --no-recursion-limit
Enables or disables a limit on the amount of recursion performed
whilst demangling strings. Since the name mangling formats allow for
an inifinite level of recursion it is possible to create strings whose
decoding will exhaust the amount of stack space available on the host
machine, triggering a memory fault. The limit tries to prevent this
from happening by restricting recursion to 1024 levels of nesting.
The default is for this limit to be enabled, but disabling it may be
necessary in order to demangle truly complicated names. Note however
that if the recursion limit is disabled then stack exhaustion is
possible and any bug reports about such an event will be rejected.
@item -D
@itemx --dynamic
@cindex dynamic symbols
@@ -2098,6 +2116,7 @@ objdump [@option{-a}|@option{--archive-headers}]
[@option{--adjust-vma=}@var{offset}]
[@option{--dwarf-depth=@var{n}}]
[@option{--dwarf-start=@var{n}}]
[@option{--no-recurse-limit}|@option{--recurse-limit}]
[@option{--special-syms}]
[@option{--prefix=}@var{prefix}]
[@option{--prefix-strip=}@var{level}]
@@ -2174,6 +2193,22 @@ mangling styles. The optional demangling style argument can be used to
choose an appropriate demangling style for your compiler. @xref{c++filt},
for more information on demangling.
@item --recurse-limit
@itemx --no-recurse-limit
@itemx --recursion-limit
@itemx --no-recursion-limit
Enables or disables a limit on the amount of recursion performed
whilst demangling strings. Since the name mangling formats allow for
an inifinite level of recursion it is possible to create strings whose
decoding will exhaust the amount of stack space available on the host
machine, triggering a memory fault. The limit tries to prevent this
from happening by restricting recursion to 1024 levels of nesting.
The default is for this limit to be enabled, but disabling it may be
necessary in order to demangle truly complicated names. Note however
that if the recursion limit is disabled then stack exhaustion is
possible and any bug reports about such an event will be rejected.
@item -g
@itemx --debugging
Display debugging information. This attempts to parse STABS
@@ -3403,6 +3438,8 @@ c++filt [@option{-_}|@option{--strip-underscore}]
[@option{-p}|@option{--no-params}]
[@option{-t}|@option{--types}]
[@option{-i}|@option{--no-verbose}]
[@option{-r}|@option{--no-recurse-limit}]
[@option{-R}|@option{--recurse-limit}]
[@option{-s} @var{format}|@option{--format=}@var{format}]
[@option{--help}] [@option{--version}] [@var{symbol}@dots{}]
@c man end
@@ -3507,6 +3544,28 @@ demangled to ``signed char''.
Do not include implementation details (if any) in the demangled
output.
@item -r
@itemx -R
@itemx --recurse-limit
@itemx --no-recurse-limit
@itemx --recursion-limit
@itemx --no-recursion-limit
Enables or disables a limit on the amount of recursion performed
whilst demangling strings. Since the name mangling formats allow for
an inifinite level of recursion it is possible to create strings whose
decoding will exhaust the amount of stack space available on the host
machine, triggering a memory fault. The limit tries to prevent this
from happening by restricting recursion to 1024 levels of nesting.
The default is for this limit to be enabled, but disabling it may be
necessary in order to demangle truly complicated names. Note however
that if the recursion limit is disabled then stack exhaustion is
possible and any bug reports about such an event will be rejected.
The @option{-r} option is a synonym for the
@option{--no-recurse-limit} option. The @option{-R} option is a
synonym for the @option{--recurse-limit} option.
@item -s @var{format}
@itemx --format=@var{format}
@command{c++filt} can decode various methods of mangling, used by
@@ -3580,6 +3639,8 @@ c++filt @var{option} @var{symbol}
addr2line [@option{-a}|@option{--addresses}]
[@option{-b} @var{bfdname}|@option{--target=}@var{bfdname}]
[@option{-C}|@option{--demangle}[=@var{style}]]
[@option{-r}|@option{--no-recurse-limit}]
[@option{-R}|@option{--recurse-limit}]
[@option{-e} @var{filename}|@option{--exe=}@var{filename}]
[@option{-f}|@option{--functions}] [@option{-s}|@option{--basename}]
[@option{-i}|@option{--inlines}]
@@ -3705,6 +3766,32 @@ Read offsets relative to the specified section instead of absolute addresses.
Make the output more human friendly: each location are printed on one line.
If option @option{-i} is specified, lines for all enclosing scopes are
prefixed with @samp{(inlined by)}.
@item -r
@itemx -R
@itemx --recurse-limit
@itemx --no-recurse-limit
@itemx --recursion-limit
@itemx --no-recursion-limit
Enables or disables a limit on the amount of recursion performed
whilst demangling strings. Since the name mangling formats allow for
an inifinite level of recursion it is possible to create strings whose
decoding will exhaust the amount of stack space available on the host
machine, triggering a memory fault. The limit tries to prevent this
from happening by restricting recursion to 1024 levels of nesting.
The default is for this limit to be enabled, but disabling it may be
necessary in order to demangle truly complicated names. Note however
that if the recursion limit is disabled then stack exhaustion is
possible and any bug reports about such an event will be rejected.
The @option{-r} option is a synonym for the
@option{--no-recurse-limit} option. The @option{-R} option is a
synonym for the @option{--recurse-limit} option.
Note this option is only effective if the @option{-C} or
@option{--demangle} option has been enabled.
@end table
@c man end