diff -rup binutils.orig/include/demangle.h binutils-2.27/include/demangle.h

--- binutils.orig/include/demangle.h	2019-01-08 13:52:32.990714670 +0000

+++ binutils-2.27/include/demangle.h	2019-01-08 13:58:42.269743403 +0000

@@ -64,9 +64,20 @@ extern "C" {

 #define DMGL_GNAT	 (1 << 15)

 #define DMGL_DLANG	 (1 << 16)

+/* Disable a limit on the depth of recursion in mangled strings.

+   Note if this limit is disabled then stack exhaustion is possible when

+   demangling pathologically complicated strings.  Bug reports about stack

+   exhaustion when the option is enabled will be rejected.  */  

+#define DMGL_NO_RECURSE_LIMIT (1 << 17)	

+

 /* If none of these are set, use 'current_demangling_style' as the default. */

 #define DMGL_STYLE_MASK (DMGL_AUTO|DMGL_GNU|DMGL_LUCID|DMGL_ARM|DMGL_HP|DMGL_EDG|DMGL_GNU_V3|DMGL_JAVA|DMGL_GNAT|DMGL_DLANG)

+/* If DMGL_NO_RECURSE_LIMIT is not enabled, then this is the value used as

+   the maximum depth of recursion allowed.  It should be enough for any

+   real-world mangled name.  */

+#define DEMANGLE_RECURSION_LIMIT 2048

+  

 /* Enumeration of possible demangling styles.

    Lucid and ARM styles are still kept logically distinct, even though

Only in binutils-2.27/include: demangle.h.orig

Only in binutils-2.27/include: #demangle.h.rej#

Only in binutils-2.27/include: .#demangle.h.rej

Only in binutils-2.27/include: demangle.h.rej

diff -rup binutils.orig/libiberty/cp-demangle.c binutils-2.27/libiberty/cp-demangle.c

--- binutils.orig/libiberty/cp-demangle.c	2019-01-08 13:52:33.161713294 +0000

+++ binutils-2.27/libiberty/cp-demangle.c	2019-01-08 13:53:30.002255949 +0000

@@ -2725,21 +2725,35 @@ d_ref_qualifier (struct d_info *di, stru

 static struct demangle_component *

 d_function_type (struct d_info *di)

 {

-  struct demangle_component *ret;

+  struct demangle_component *ret = NULL;

-  if (! d_check_char (di, 'F'))

-    return NULL;

-  if (d_peek_char (di) == 'Y')

+  if ((di->options & DMGL_NO_RECURSE_LIMIT) == 0)

     {

-      /* Function has C linkage.  We don't print this information.

-	 FIXME: We should print it in verbose mode.  */

-      d_advance (di, 1);

+      if (di->recursion_level > DEMANGLE_RECURSION_LIMIT)

+	/* FIXME: There ought to be a way to report

+	   that the recursion limit has been reached.  */

+	return NULL;

+

+      di->recursion_level ++;

     }

-  ret = d_bare_function_type (di, 1);

-  ret = d_ref_qualifier (di, ret);

-  if (! d_check_char (di, 'E'))

-    return NULL;

+  if (d_check_char (di, 'F'))

+    {

+      if (d_peek_char (di) == 'Y')

+	{

+	  /* Function has C linkage.  We don't print this information.

+	     FIXME: We should print it in verbose mode.  */

+	  d_advance (di, 1);

+	}

+      ret = d_bare_function_type (di, 1);

+      ret = d_ref_qualifier (di, ret);

+      

+      if (! d_check_char (di, 'E'))

+	ret = NULL;

+    }

+

+  if ((di->options & DMGL_NO_RECURSE_LIMIT) == 0)

+    di->recursion_level --;

   return ret;

 }

@@ -5898,6 +5912,7 @@ cplus_demangle_init_info (const char *ma

   di->expansion = 0;

   di->is_expression = 0;

   di->is_conversion = 0;

+  di->recursion_level = 0;

 }

 /* Internal implementation for the demangler.  If MANGLED is a g++ v3 ABI

@@ -5937,6 +5952,20 @@ d_demangle_callback (const char *mangled

   cplus_demangle_init_info (mangled, options, strlen (mangled), &di);

+  /* PR 87675 - Check for a mangled string that is so long

+     that we do not have enough stack space to demangle it.  */

+  if (((options & DMGL_NO_RECURSE_LIMIT) == 0)

+      /* This check is a bit arbitrary, since what we really want to do is to

+	 compare the sizes of the di.comps and di.subs arrays against the

+	 amount of stack space remaining.  But there is no portable way to do

+	 this, so instead we use the recursion limit as a guide to the maximum

+	 size of the arrays.  */

+      && (unsigned long) di.num_comps > DEMANGLE_RECURSION_LIMIT)

+    {

+      /* FIXME: We need a way to indicate that a stack limit has been reached.  */

+      return 0;

+    }

+

   {

 #ifdef CP_DYNAMIC_ARRAYS

     __extension__ struct demangle_component comps[di.num_comps];

Only in binutils-2.27/libiberty: cp-demangle.c.orig

diff -rup binutils.orig/libiberty/cp-demangle.h binutils-2.27/libiberty/cp-demangle.h

--- binutils.orig/libiberty/cp-demangle.h	2019-01-08 13:52:33.161713294 +0000

+++ binutils-2.27/libiberty/cp-demangle.h	2019-01-08 13:53:30.003255941 +0000

@@ -127,6 +127,9 @@ struct d_info

   /* Non-zero if we are parsing the type operand of a conversion

      operator, but not when in an expression.  */

   int is_conversion;

+  /* If DMGL_NO_RECURSE_LIMIT is not active then this is set to

+     the current recursion level.  */

+  unsigned int recursion_level;

 };

 /* To avoid running past the ending '\0', don't:

Only in binutils-2.27/libiberty: cp-demangle.h.orig

diff -rup binutils.orig/libiberty/cplus-dem.c binutils-2.27/libiberty/cplus-dem.c

--- binutils.orig/libiberty/cplus-dem.c	2019-01-08 13:52:33.161713294 +0000

+++ binutils-2.27/libiberty/cplus-dem.c	2019-01-08 14:10:00.057340821 +0000

@@ -137,6 +137,7 @@ struct work_stuff

   string* previous_argument; /* The last function argument demangled.  */

   int nrepeats;         /* The number of times to repeat the previous

 			   argument.  */

+  unsigned int recursion_level;

 };

 #define PRINT_ANSI_QUALIFIERS (work -> options & DMGL_ANSI)

@@ -1237,11 +1238,15 @@ squangle_mop_up (struct work_stuff *work

     {

       free ((char *) work -> btypevec);

       work->btypevec = NULL;

+      work->bsize = 0;

+      work->numb = 0;

     }

   if (work -> ktypevec != NULL)

     {

       free ((char *) work -> ktypevec);

       work->ktypevec = NULL;

+      work->ksize = 0;

+      work->numk = 0;

     }

 }

@@ -1275,8 +1280,15 @@ work_stuff_copy_to_from (struct work_stu

   for (i = 0; i < from->numk; i++)

     {

-      int len = strlen (from->ktypevec[i]) + 1;

+      int len;

+      if (from->ktypevec[i] == NULL)

+	{

+	  to->ktypevec[i] = NULL;

+	  continue;

+	}

+

+      len = strlen (from->ktypevec[i]) + 1;

       to->ktypevec[i] = XNEWVEC (char, len);

       memcpy (to->ktypevec[i], from->ktypevec[i], len);

     }

@@ -1286,8 +1298,15 @@ work_stuff_copy_to_from (struct work_stu

   for (i = 0; i < from->numb; i++)

     {

-      int len = strlen (from->btypevec[i]) + 1;

+      int len;

+      if (from->btypevec[i] == NULL)

+	{

+	  to->btypevec[i] = NULL;

+	  continue;

+	}

+

+      len = strlen (from->btypevec[i]) + 1;

       to->btypevec[i] = XNEWVEC (char , len);

       memcpy (to->btypevec[i], from->btypevec[i], len);

     }

@@ -1335,6 +1354,7 @@ delete_non_B_K_work_stuff (struct work_s

       free ((char*) work->tmpl_argvec);

       work->tmpl_argvec = NULL;

+      work->ntmpl_args = 0;

     }

   if (work->previous_argument)

     {

@@ -3347,6 +3367,20 @@ demangle_qualified (struct work_stuff *w

       success = 0;

     }

+  if ((work->options & DMGL_NO_RECURSE_LIMIT) == 0)

+    {

+      /* PR 87241: Catch malicious input that will try to trick this code into

+	 allocating a ridiculous amount of memory via the remember_Ktype()

+	 function.

+	 The choice of DEMANGLE_RECURSION_LIMIT is somewhat arbitrary.  Possibly

+	 a better solution would be to track how much memory remember_Ktype

+	 allocates and abort when some upper limit is reached.  */

+      if (qualifiers > DEMANGLE_RECURSION_LIMIT)

+	/* FIXME: We ought to have some way to tell the user that

+	   this limit has been reached.  */

+	success = 0;

+    }

+

   if (!success)

     return success;

@@ -4335,6 +4369,7 @@ remember_Btype (struct work_stuff *work,

 }

 /* Lose all the info related to B and K type codes. */

+

 static void

 forget_B_and_K_types (struct work_stuff *work)

 {

@@ -4360,6 +4395,7 @@ forget_B_and_K_types (struct work_stuff

 	}

     }

 }

+

 /* Forget the remembered types, but not the type vector itself.  */

 static void

@@ -4551,6 +4587,16 @@ demangle_nested_args (struct work_stuff

   int result;

   int saved_nrepeats;

+  if ((work->options & DMGL_NO_RECURSE_LIMIT) == 0)

+    {

+      if (work->recursion_level > DEMANGLE_RECURSION_LIMIT)

+	/* FIXME: There ought to be a way to report

+	   that the recursion limit has been reached.  */

+	return 0;

+

+      work->recursion_level ++;

+    }

+

   /* The G++ name-mangling algorithm does not remember types on nested

      argument lists, unless -fsquangling is used, and in that case the

      type vector updated by remember_type is not used.  So, we turn

@@ -4577,6 +4623,9 @@ demangle_nested_args (struct work_stuff

   --work->forgetting_types;

   work->nrepeats = saved_nrepeats;

+  if ((work->options & DMGL_NO_RECURSE_LIMIT) == 0)

+    --work->recursion_level;

+

   return result;

 }

Only in binutils-2.27/libiberty: cplus-dem.c.orig

Only in binutils-2.27/libiberty: cplus-dem.c.rej