re PR other/22268 (libiberty demanger crashes on (invalid) mangled name)

	PR other/22268
	* cp-demangle.c (d_expr_primary): Don't run off the end of the
	string while looking for the end of a literal value.
	* testsuite/demangle-expected: Add test case.

From-SVN: r101506

diff --git a/libiberty/ChangeLog b/libiberty/ChangeLog
index 2522b8270e61b5bfd8873de01d073b0b67ad6ebc..eb19aa71e4c041ecd1a9d078f0bb6fadb738f12d 100644 (file)
--- a/libiberty/ChangeLog
+++ b/libiberty/ChangeLog
@@ -1,3 +1,10 @@
+2005-07-01  Ian Lance Taylor  <ian@airs.com>
+
+       PR other/22268
+       * cp-demangle.c (d_expr_primary): Don't run off the end of the
+       string while looking for the end of a literal value.
+       * testsuite/demangle-expected: Add test case.
+
 2005-06-30  Daniel Berlin  <dberlin@dberlin.org>
 
        * hashtab.c (EMPTY_ENTRY): Moved and renamed.

diff --git a/libiberty/cp-demangle.c b/libiberty/cp-demangle.c
index 61744390725ef1201ff3b58f5da166bb3976a2c7..8f1cfb17f87f2734e0b756390eeaa94a69dc87ab 100644 (file)
--- a/libiberty/cp-demangle.c
+++ b/libiberty/cp-demangle.c
@@ -2337,7 +2337,11 @@ d_expr_primary (struct d_info *di)
        }
       s = d_str (di);
       while (d_peek_char (di) != 'E')
-       d_advance (di, 1);
+       {
+         if (d_peek_char (di) == '\0')
+           return NULL;
+         d_advance (di, 1);
+       }
       ret = d_make_comp (di, t, type, d_make_name (di, s, d_str (di) - s));
     }
   if (d_next_char (di) != 'E')

diff --git a/libiberty/testsuite/demangle-expected b/libiberty/testsuite/demangle-expected
index f8e402d01bda3b2bb071cba76c58b1609244a05d..4526773a780a55cf96e7d077a2e45aec6669f5d9 100644 (file)
--- a/libiberty/testsuite/demangle-expected
+++ b/libiberty/testsuite/demangle-expected
@@ -3704,6 +3704,12 @@ foo<int (*) [3]>
 _ZN13PatternDriver23StringScalarDeleteValueC1ERKNS_25ConflateStringScalarValueERKNS_25AbstractStringScalarValueERKNS_12TemplateEnumINS_12pdcomplementELZNS_16complement_namesEELZNS_14COMPLEMENTENUMEEEE
 _ZN13PatternDriver23StringScalarDeleteValueC1ERKNS_25ConflateStringScalarValueERKNS_25AbstractStringScalarValueERKNS_12TemplateEnumINS_12pdcomplementELZNS_16complement_namesEELZNS_14COMPLEMENTENUMEEEE
 PatternDriver::StringScalarDeleteValue::StringScalarDeleteValue
+#
+# This used to cause the demangler to walk into undefined memory--PR 22268
+--format=gnu-v3 --no-params
+ALsetchannels
+ALsetchannels
+ALsetchannels
 # Test GNU V3 constructor and destructor identification.
 # 0 means it is not a constructor/destructor.
 # Other integers correspond to enum gnu_v3_{c,d}tor_kinds in demangle.h.