pr106641

# DP: Fix PR demangler/106641, taken from the trunk.

# DP: Fix PR demangler/106641, taken from the trunk.

libiberty: fix resource exhaustion in rust demangler (PR demangler/106641)

demangle_binder() parses the bound_lifetimes count as a base-62
integer with no upper bound.  A crafted symbol can encode a huge
lifetime count in very few bytes, causing OOM or CPU hang.

Cap bound_lifetimes at 1024 and check rdm->errored in the loop
so it bails out early on errors during iteration.

libiberty/ChangeLog:

        PR demangler/106641
        * rust-demangle.c (demangle_binder): Reject bound_lifetimes
        above 1024 to prevent resource exhaustion from crafted symbols.
        Add rdm->errored check in the loop condition.
        * testsuite/rust-demangle-expected: Add regression test.

Gbp-Pq: Name pr106641.diff

diff --git a/libiberty/rust-demangle.c b/libiberty/rust-demangle.c
index 190709996545fbc1877ab693b56c0c4979e1f0ff..013f14eebac3baf35b4ed5f7f77971b2ea85da10 100644 (file)
--- a/libiberty/rust-demangle.c
+++ b/libiberty/rust-demangle.c
@@ -651,10 +651,17 @@ demangle_binder (struct rust_demangler *rdm)
     return;
 
   bound_lifetimes = parse_opt_integer_62 (rdm, 'G');
+  /* Reject implausibly large lifetime counts to prevent
+     resource exhaustion from crafted symbols (PR demangler/106641).  */
+  if (bound_lifetimes > 1024)
+    {
+      rdm->errored = 1;
+      return;
+    }
   if (bound_lifetimes > 0)
     {
       PRINT ("for<");
-      for (i = 0; i < bound_lifetimes; i++)
+      for (i = 0; i < bound_lifetimes && !rdm->errored; i++)
         {
           if (i > 0)
             PRINT (", ");

diff --git a/libiberty/testsuite/rust-demangle-expected b/libiberty/testsuite/rust-demangle-expected
index b565084cfefae2d272659f1f059fe514b196222c..acadf7c9b83b22294090e1ac84560fc99ba052e7 100644 (file)
--- a/libiberty/testsuite/rust-demangle-expected
+++ b/libiberty/testsuite/rust-demangle-expected
@@ -321,3 +321,9 @@ foo
 --format=rust
 _RNvC9backtrace3foo.llvm.A5310EB9
 backtrace::foo
+#
+# PR demangler/106641: crafted symbol with huge lifetime count
+# should not cause resource exhaustion.
+--format=rust
+_RINvC4te_C4tokpppppppppppFFFFFFGFpppppppppKj2_FFFFFFFFFFFFFE
+_RINvC4te_C4tokpppppppppppFFFFFFGFpppppppppKj2_FFFFFFFFFFFFFE