llvm-project/libcxxabi
Mikhail Borisov f0fcd42495 [libc++abi] Fix possible infinite loop in itanium demangler
A libfuzzer run has discovered some inputs for which the demangler does
not terminate. When minimized, it looks like this: _Zcv1BIRT_EIS1_E

Deciphered:

_Z
cv    - conversion operator

      * result type
 1B   - "B"
 I    - template args begin
  R   - reference type              <.
   T_ - forward template reference   |  *
 E    - template args end            |  |
                                     |  |
      * parameter type               |  |
 I    - template args begin          |  |
  S1_ - substitution #1              * <'
 E    - template args end

The reason is: template-parameter refs in conversion operator result type
create forward-references, while substitutions are instantly resolved via
back-references. Together these can create a reference loop. It causes an
infinite loop in ReferenceType::collapse().

I see three possible ways to avoid these loops:

1. check if resolving a forward reference creates a loop and reject the
   invalid input (hard to traverse AST at this point)
2. check if a substitution contains a malicious forward reference and
   reject the invalid input (hard to traverse AST at this point;
   substitutions are quite common: may affect performance; hard to
   clearly detect loops at this point)
3. detect loops in ReferenceType::collapse() (cannot reject the input)

This patch implements (3) as seemingly the least-impact change. As a
side effect, such invalid input strings are not rejected and produce
garbage, however there are already similar guards in
`if (Printing) return;` checks.

Fixes https://llvm.org/PR51407

Differential Revision: https://reviews.llvm.org/D107712
2021-08-17 18:13:26 -04:00
..
cmake [runtimes] Don't try passing --target flags to GCC 2021-07-15 16:52:02 -04:00
fuzz
include [libcxxabi] Define _LIBCXXABI_WEAK properly for mingw compilers 2020-10-22 09:00:57 +03:00
lib [libc++/abi] Revert "[libc++] Move the weak symbols list to libc++abi" 2020-10-05 11:42:13 -04:00
src [libc++abi] Fix possible infinite loop in itanium demangler 2021-08-17 18:13:26 -04:00
test [libc++abi] Fix possible infinite loop in itanium demangler 2021-08-17 18:13:26 -04:00
www [Branch-Rename] Fix some links 2021-02-01 16:43:21 +05:30
.clang-format
.gitignore
CMakeLists.txt [runtimes] Simplify how we set the target triple 2021-07-16 10:33:39 -04:00
CREDITS.TXT
LICENSE.TXT Fix typos throughout the license files that somehow I and my reviewers 2019-01-21 09:52:34 +00:00