Blame SOURCES/binutils-CVE-2019-9071.patch

0e5f8d
--- binutils.orig/libiberty/cp-demangle.c	2019-04-10 10:31:27.854997707 +0100
0e5f8d
+++ binutils-2.31.1/libiberty/cp-demangle.c	2019-04-10 16:00:35.820350978 +0100
0e5f8d
@@ -858,7 +858,7 @@ CP_STATIC_IF_GLIBCPP_V3
0e5f8d
 int
0e5f8d
 cplus_demangle_fill_name (struct demangle_component *p, const char *s, int len)
0e5f8d
 {
0e5f8d
-  if (p == NULL || s == NULL || len == 0)
0e5f8d
+  if (p == NULL || s == NULL || len <= 0)
0e5f8d
     return 0;
0e5f8d
   p->d_printing = 0;
0e5f8d
   p->type = DEMANGLE_COMPONENT_NAME;
0e5f8d
@@ -4032,7 +4032,7 @@ d_growable_string_callback_adapter (cons
0e5f8d
    are larger than the actual numbers encountered.  */
0e5f8d
 
0e5f8d
 static void
0e5f8d
-d_count_templates_scopes (int *num_templates, int *num_scopes,
0e5f8d
+d_count_templates_scopes (struct d_print_info *dpi,
0e5f8d
 			  const struct demangle_component *dc)
0e5f8d
 {
0e5f8d
   if (dc == NULL)
0e5f8d
@@ -4052,13 +4052,13 @@ d_count_templates_scopes (int *num_templ
0e5f8d
       break;
0e5f8d
 
0e5f8d
     case DEMANGLE_COMPONENT_TEMPLATE:
0e5f8d
-      (*num_templates)++;
0e5f8d
+      dpi->num_copy_templates++;
0e5f8d
       goto recurse_left_right;
0e5f8d
 
0e5f8d
     case DEMANGLE_COMPONENT_REFERENCE:
0e5f8d
     case DEMANGLE_COMPONENT_RVALUE_REFERENCE:
0e5f8d
       if (d_left (dc)->type == DEMANGLE_COMPONENT_TEMPLATE_PARAM)
0e5f8d
-	(*num_scopes)++;
0e5f8d
+	dpi->num_saved_scopes++;
0e5f8d
       goto recurse_left_right;
0e5f8d
 
0e5f8d
     case DEMANGLE_COMPONENT_QUAL_NAME:
0e5f8d
@@ -4122,42 +4122,42 @@ d_count_templates_scopes (int *num_templ
0e5f8d
     case DEMANGLE_COMPONENT_TAGGED_NAME:
0e5f8d
     case DEMANGLE_COMPONENT_CLONE:
0e5f8d
     recurse_left_right:
0e5f8d
-      d_count_templates_scopes (num_templates, num_scopes,
0e5f8d
-				d_left (dc));
0e5f8d
-      d_count_templates_scopes (num_templates, num_scopes,
0e5f8d
-				d_right (dc));
0e5f8d
+      /* PR 89394 - Check for too much recursion.  */
0e5f8d
+      if (dpi->recursion > DEMANGLE_RECURSION_LIMIT)
0e5f8d
+	/* FIXME: There ought to be a way to report to the
0e5f8d
+	   user that the recursion limit has been reached.  */
0e5f8d
+	return;
0e5f8d
+
0e5f8d
+      ++ dpi->recursion;
0e5f8d
+      d_count_templates_scopes (dpi, d_left (dc));
0e5f8d
+      d_count_templates_scopes (dpi, d_right (dc));
0e5f8d
+      -- dpi->recursion;
0e5f8d
       break;
0e5f8d
 
0e5f8d
     case DEMANGLE_COMPONENT_CTOR:
0e5f8d
-      d_count_templates_scopes (num_templates, num_scopes,
0e5f8d
-				dc->u.s_ctor.name);
0e5f8d
+      d_count_templates_scopes (dpi, dc->u.s_ctor.name);
0e5f8d
       break;
0e5f8d
 
0e5f8d
     case DEMANGLE_COMPONENT_DTOR:
0e5f8d
-      d_count_templates_scopes (num_templates, num_scopes,
0e5f8d
-				dc->u.s_dtor.name);
0e5f8d
+      d_count_templates_scopes (dpi, dc->u.s_dtor.name);
0e5f8d
       break;
0e5f8d
 
0e5f8d
     case DEMANGLE_COMPONENT_EXTENDED_OPERATOR:
0e5f8d
-      d_count_templates_scopes (num_templates, num_scopes,
0e5f8d
-				dc->u.s_extended_operator.name);
0e5f8d
+      d_count_templates_scopes (dpi, dc->u.s_extended_operator.name);
0e5f8d
       break;
0e5f8d
 
0e5f8d
     case DEMANGLE_COMPONENT_FIXED_TYPE:
0e5f8d
-      d_count_templates_scopes (num_templates, num_scopes,
0e5f8d
-                                dc->u.s_fixed.length);
0e5f8d
+      d_count_templates_scopes (dpi, dc->u.s_fixed.length);
0e5f8d
       break;
0e5f8d
 
0e5f8d
     case DEMANGLE_COMPONENT_GLOBAL_CONSTRUCTORS:
0e5f8d
     case DEMANGLE_COMPONENT_GLOBAL_DESTRUCTORS:
0e5f8d
-      d_count_templates_scopes (num_templates, num_scopes,
0e5f8d
-				d_left (dc));
0e5f8d
+      d_count_templates_scopes (dpi, d_left (dc));
0e5f8d
       break;
0e5f8d
 
0e5f8d
     case DEMANGLE_COMPONENT_LAMBDA:
0e5f8d
     case DEMANGLE_COMPONENT_DEFAULT_ARG:
0e5f8d
-      d_count_templates_scopes (num_templates, num_scopes,
0e5f8d
-				dc->u.s_unary_num.sub);
0e5f8d
+      d_count_templates_scopes (dpi, dc->u.s_unary_num.sub);
0e5f8d
       break;
0e5f8d
     }
0e5f8d
 }
0e5f8d
@@ -4192,8 +4192,12 @@ d_print_init (struct d_print_info *dpi,
0e5f8d
   dpi->next_copy_template = 0;
0e5f8d
   dpi->num_copy_templates = 0;
0e5f8d
 
0e5f8d
-  d_count_templates_scopes (&dpi->num_copy_templates,
0e5f8d
-			    &dpi->num_saved_scopes, dc);
0e5f8d
+  d_count_templates_scopes (dpi, dc);
0e5f8d
+  /* If we did not reach the recursion limit, then reset the
0e5f8d
+     current recursion value back to 0, so that we can print
0e5f8d
+     the templates.  */
0e5f8d
+  if (dpi->recursion < DEMANGLE_RECURSION_LIMIT)
0e5f8d
+    dpi->recursion = 0;
0e5f8d
   dpi->num_copy_templates *= dpi->num_saved_scopes;
0e5f8d
 
0e5f8d
   dpi->current_template = NULL;