Attachment #475106 for bug #620492




2016-08-04  Marcel Böhme  <boehme.marcel@gmail.com>

	PR c++/71696
	* cplus-dem.c: Prevent infinite recursion when there is a cycle
	in the referencing of remembered mangled types.
	(work_stuff): New stack to keep track of the remembered mangled
	types that are currently being processed.
	(push_processed_type): New method to push currently processed
	remembered type onto the stack.
	(pop_processed_type): New method to pop currently processed
	remembered type from the stack.
	(work_stuff_copy_to_from): Copy values of new variables.
	(delete_non_B_K_work_stuff): Free stack memory.
	(demangle_args): Push/Pop currently processed remembered type.
	(do_type): Do not demangle a cyclic reference and push/pop
	referenced remembered type.

2016-06-03  Release Manager

	* GCC 5.4.0 released.

Lines 144-149 struct work_stuff Link Here

(-)a/libiberty/cplus-dem.c (-5 / +73 lines)
144	string* previous_argument; /* The last function argument demangled. */	144	string* previous_argument; /* The last function argument demangled. */
145	int nrepeats; /* The number of times to repeat the previous	145	int nrepeats; /* The number of times to repeat the previous
146	argument. */	146	argument. */
		147	int proctypevec; / Indices of currently processed remembered typevecs. */
		148	int proctypevec_size;
		149	int nproctypes;
147	};	150	};
148		151
149	#define PRINT_ANSI_QUALIFIERS (work -> options & DMGL_ANSI)	152	#define PRINT_ANSI_QUALIFIERS (work -> options & DMGL_ANSI)
Lines 435-440 iterate_demangle_function (struct work_stuff *, Link Here
435		438
436	static void remember_type (struct work_stuff , const char , int);	439	static void remember_type (struct work_stuff , const char , int);
437		440
		441	static void push_processed_type (struct work_stuff *, int);
		442
		443	static void pop_processed_type (struct work_stuff *);
		444
438	static void remember_Btype (struct work_stuff , const char , int, int);	445	static void remember_Btype (struct work_stuff , const char , int, int);
439		446
440	static int register_Btype (struct work_stuff *);	447	static int register_Btype (struct work_stuff *);
Lines 1301-1306 work_stuff_copy_to_from (struct work_stuff to, struct work_stuff from) Link Here
1301	memcpy (to->btypevec[i], from->btypevec[i], len);	1308	memcpy (to->btypevec[i], from->btypevec[i], len);
1302	}	1309	}
1303		1310
		1311	if (from->proctypevec)
		1312	to->proctypevec =
		1313	XDUPVEC (int, from->proctypevec, from->proctypevec_size);
		1314
1304	if (from->ntmpl_args)	1315	if (from->ntmpl_args)
1305	to->tmpl_argvec = XNEWVEC (char *, from->ntmpl_args);	1316	to->tmpl_argvec = XNEWVEC (char *, from->ntmpl_args);
1306		1317
Lines 1329-1339 delete_non_B_K_work_stuff (struct work_stuff *work) Link Here
1329	/* Discard the remembered types, if any. */	1340	/* Discard the remembered types, if any. */
1330		1341
1331	forget_types (work);	1342	forget_types (work);
1332	if (work -> typevec != NULL)	1343	if (work->typevec != NULL)
1333	{	1344	{
1334	free ((char *) work -> typevec);	1345	free ((char *) work->typevec);
1335	work -> typevec = NULL;	1346	work->typevec = NULL;
1336	work -> typevec_size = 0;	1347	work->typevec_size = 0;
		1348	}
		1349	if (work->proctypevec != NULL)
		1350	{
		1351	free (work->proctypevec);
		1352	work->proctypevec = NULL;
		1353	work->proctypevec_size = 0;
1337	}	1354	}
1338	if (work->tmpl_argvec)	1355	if (work->tmpl_argvec)
1339	{	1356	{
Lines 3552-3557 static int Link Here
3552	do_type (struct work_stuff work, const char mangled, string result)	3569	do_type (struct work_stuff work, const char mangled, string result)
3553	{	3570	{
3554	int n;	3571	int n;
		3572	int i;
		3573	int is_proctypevec;
3555	int done;	3574	int done;
3556	int success;	3575	int success;
3557	string decl;	3576	string decl;
Lines 3564-3569 do_type (struct work_stuff work, const char mangled, string result) Link Here
3564		3583
3565	done = 0;	3584	done = 0;
3566	success = 1;	3585	success = 1;
		3586	is_proctypevec = 0;
3567	while (success && !done)	3587	while (success && !done)
3568	{	3588	{
3569	int member;	3589	int member;
Lines 3616-3623 do_type (struct work_stuff work, const char mangled, string result) Link Here
3616	success = 0;	3636	success = 0;
3617	}	3637	}
3618	else	3638	else
		3639	for (i = 0; i < work->nproctypes; i++)
		3640	if (work -> proctypevec [i] == n)
		3641	success = 0;
		3642
		3643	if (success)
3619	{	3644	{
3620	remembered_type = work -> typevec[n];	3645	is_proctypevec = 1;
		3646	push_processed_type (work, n);
		3647	remembered_type = work->typevec[n];
3621	mangled = &remembered_type;	3648	mangled = &remembered_type;
3622	}	3649	}
3623	break;	3650	break;
Lines 3840-3845 do_type (struct work_stuff work, const char mangled, string result) Link Here
3840	string_delete (result);	3867	string_delete (result);
3841	string_delete (&decl);	3868	string_delete (&decl);
3842		3869
		3870	if (is_proctypevec)
		3871	pop_processed_type (work);
		3872
3843	if (success)	3873	if (success)
3844	/* Assume an integral type, if we're not sure. */	3874	/* Assume an integral type, if we're not sure. */
3845	return (int) ((tk == tk_none) ? tk_integral : tk);	3875	return (int) ((tk == tk_none) ? tk_integral : tk);
Lines 4252-4257 do_arg (struct work_stuff work, const char mangled, string result) Link Here
4252	}	4282	}
4253		4283
4254	static void	4284	static void
		4285	push_processed_type (struct work_stuff *work, int typevec_index)
		4286	{
		4287	if (work->nproctypes >= work->proctypevec_size)
		4288	{
		4289	if (!work->proctypevec_size)
		4290	{
		4291	work->proctypevec_size = 4;
		4292	work->proctypevec = XNEWVEC (int, work->proctypevec_size);
		4293	}
		4294	else
		4295	{
		4296	if (work->proctypevec_size < 16)
		4297	/* Double when small. */
		4298	work->proctypevec_size *= 2;
		4299	else
		4300	{
		4301	/* Grow slower when large. */
		4302	if (work->proctypevec_size > (INT_MAX / 3) * 2)
		4303	xmalloc_failed (INT_MAX);
		4304	work->proctypevec_size = (work->proctypevec_size * 3 / 2);
		4305	}
		4306	work->proctypevec
		4307	= XRESIZEVEC (int, work->proctypevec, work->proctypevec_size);
		4308	}
		4309	}
		4310	work->proctypevec [work->nproctypes++] = typevec_index;
		4311	}
		4312
		4313	static void
		4314	pop_processed_type (struct work_stuff *work)
		4315	{
		4316	work->nproctypes--;
		4317	}
		4318
		4319	static void
4255	remember_type (struct work_stuff work, const char start, int len)	4320	remember_type (struct work_stuff work, const char start, int len)
4256	{	4321	{
4257	char *tem;	4322	char *tem;
Lines 4515-4524 demangle_args (struct work_stuff work, const char *mangled, Link Here
4515	{	4580	{
4516	string_append (declp, ", ");	4581	string_append (declp, ", ");
4517	}	4582	}
		4583	push_processed_type (work, t);
4518	if (!do_arg (work, &tem, &arg))	4584	if (!do_arg (work, &tem, &arg))
4519	{	4585	{
		4586	pop_processed_type (work);
4520	return (0);	4587	return (0);
4521	}	4588	}
		4589	pop_processed_type (work);
4522	if (PRINT_ARG_TYPES)	4590	if (PRINT_ARG_TYPES)
4523	{	4591	{
4524	string_appends (declp, &arg);	4592	string_appends (declp, &arg);





_Z80800000000000000000000
_Z80800000000000000000000
#
# Tests write access violation PR70926

0__Ot2m02R5T0000500000
0__Ot2m02R5T0000500000
#

0__GT50000000000_
0__GT50000000000_
#

__t2m05B500000000000000000_
__t2m05B500000000000000000_
#
# Tests stack overflow PR71696

__10%0__S4_0T0T0
%0<>::%0(%0<>)

Return to bug 620492

Lines 4429-4431 __vt_90000000000cafebabe Link Here

(-)a/libiberty/testsuite/demangle-expected (-1 / +18 lines)
4429		4429
4430	_Z80800000000000000000000	4430	_Z80800000000000000000000
4431	_Z80800000000000000000000	4431	_Z80800000000000000000000
4432	-	4432	#
		4433	# Tests write access violation PR70926
		4434
		4435	0__Ot2m02R5T0000500000
		4436	0__Ot2m02R5T0000500000
		4437	#
		4438
		4439	0__GT50000000000_
		4440	0__GT50000000000_
		4441	#
		4442
		4443	__t2m05B500000000000000000_
		4444	__t2m05B500000000000000000_
		4445	#
		4446	# Tests stack overflow PR71696
		4447
		4448	__10%0__S4_0T0T0
		4449	%0<>::%0(%0<>)

Lines 1-3 Link Here

(-)a/libiberty/ChangeLog (+17 lines)
		1	2016-08-04 Marcel Böhme <boehme.marcel@gmail.com>
		2
		3	PR c++/71696
		4	* cplus-dem.c: Prevent infinite recursion when there is a cycle
		5	in the referencing of remembered mangled types.
		6	(work_stuff): New stack to keep track of the remembered mangled
		7	types that are currently being processed.
		8	(push_processed_type): New method to push currently processed
		9	remembered type onto the stack.
		10	(pop_processed_type): New method to pop currently processed
		11	remembered type from the stack.
		12	(work_stuff_copy_to_from): Copy values of new variables.
		13	(delete_non_B_K_work_stuff): Free stack memory.
		14	(demangle_args): Push/Pop currently processed remembered type.
		15	(do_type): Do not demangle a cyclic reference and push/pop
		16	referenced remembered type.
		17
1	2016-06-03 Release Manager	18	2016-06-03 Release Manager
2		19
3	* GCC 5.4.0 released.	20	* GCC 5.4.0 released.