Blame SOURCES/binutils-CVE-2021-3530.patch

129ae9
--- binutils.orig/libiberty/rust-demangle.c	2021-05-07 17:13:43.762229783 +0100
129ae9
+++ binutils-2.36.1/libiberty/rust-demangle.c	2021-05-07 17:14:39.805820593 +0100
129ae9
@@ -74,6 +74,12 @@ struct rust_demangler
129ae9
   /* Rust mangling version, with legacy mangling being -1. */
129ae9
   int version;
129ae9
 
129ae9
+  /* Recursion depth.  */
129ae9
+  uint recursion;
129ae9
+  /* Maximum number of times demangle_path may be called recursively.  */
129ae9
+#define RUST_MAX_RECURSION_COUNT  1024
129ae9
+#define RUST_NO_RECURSION_LIMIT   ((uint) -1)
129ae9
+
129ae9
   uint64_t bound_lifetime_depth;
129ae9
 };
129ae9
 
129ae9
@@ -671,6 +677,15 @@ demangle_path (struct rust_demangler *rd
129ae9
   if (rdm->errored)
129ae9
     return;
129ae9
 
129ae9
+  if (rdm->recursion != RUST_NO_RECURSION_LIMIT)
129ae9
+    {
129ae9
+      ++ rdm->recursion;
129ae9
+      if (rdm->recursion > RUST_MAX_RECURSION_COUNT)
129ae9
+	/* FIXME: There ought to be a way to report
129ae9
+	   that the recursion limit has been reached.  */
129ae9
+	goto fail_return;
129ae9
+    }
129ae9
+
129ae9
   switch (tag = next (rdm))
129ae9
     {
129ae9
     case 'C':
129ae9
@@ -688,10 +703,7 @@ demangle_path (struct rust_demangler *rd
129ae9
     case 'N':
129ae9
       ns = next (rdm);
129ae9
       if (!ISLOWER (ns) && !ISUPPER (ns))
129ae9
-        {
129ae9
-          rdm->errored = 1;
129ae9
-          return;
129ae9
-        }
129ae9
+	goto fail_return;
129ae9
 
129ae9
       demangle_path (rdm, in_value);
129ae9
 
129ae9
@@ -776,9 +788,15 @@ demangle_path (struct rust_demangler *rd
129ae9
         }
129ae9
       break;
129ae9
     default:
129ae9
-      rdm->errored = 1;
129ae9
-      return;
129ae9
+      goto fail_return;
129ae9
     }
129ae9
+  goto pass_return;
129ae9
+
129ae9
+ fail_return:
129ae9
+  rdm->errored = 1;
129ae9
+ pass_return:
129ae9
+  if (rdm->recursion != RUST_NO_RECURSION_LIMIT)
129ae9
+    -- rdm->recursion;
129ae9
 }
129ae9
 
129ae9
 static void
129ae9
@@ -1317,6 +1335,7 @@ rust_demangle_callback (const char *mang
129ae9
   rdm.skipping_printing = 0;
129ae9
   rdm.verbose = (options & DMGL_VERBOSE) != 0;
129ae9
   rdm.version = 0;
129ae9
+  rdm.recursion = (options & DMGL_NO_RECURSE_LIMIT) ? RUST_NO_RECURSION_LIMIT : 0;
129ae9
   rdm.bound_lifetime_depth = 0;
129ae9
 
129ae9
   /* Rust symbols always start with _R (v0) or _ZN (legacy). */