https://sourceware.org/bugzilla/show_bug.cgi?id=34474
Bug ID: 34474
Summary: c++filt: stack-overflow (infinite recursion) in
libiberty D demangler (dlang_function_type /
dlang_type / dlang_function_args /
dlang_function_type_noreturn)
Product: binutils
Version: 2.47
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: binutils
Assignee: unassigned at sourceware dot org
Reporter: 2722900221 at qq dot com
Target Milestone: ---
Created attachment 16899
--> https://sourceware.org/bugzilla/attachment.cgi?id=16899&action=edit
PoC
### Summary
`c++filt` exhausts the stack (SIGABRT via ASAN's stack-overflow check) on a
crafted mangled symbol. The D-language demangler in libiberty (`d-demangle.c`)
contains a mutually recursive cycle with no depth bound:
`dlang_function_type` → `dlang_type` → `dlang_function_args` →
`dlang_function_type_noreturn` → `dlang_function_type` … . A mangled input that
opens an unbalanced chain of function-type/argument productions drives this
recursion until the stack overflows.
Because the demangler is shared via libiberty, the same input crashes every
consumer that demangles attacker-controlled symbols — `c++filt`, `addr2line`,
`objdump -C`, `nm -C`, etc. Stack-exhaustion DoS in the demangler is a
recurring bug class (several historical CVEs in cp-demangle / d-demangle).
### Affected version
GNU Binutils **2.47.50.20260803**, commit `5c78aef60`.
### Reproduce
```bash
ASAN_OPTIONS=abort_on_error=1:symbolize=1:detect_leaks=0:allocator_may_return_null=1
\
./install/bin/c++filt < cxxfilt_dlang_stackoverflow.min
```
### ASAN log
```
AddressSanitizer:DEADLYSIGNAL
... (recursion repeats for ~300 frames) ...
#0 0x5555556c597b in __asan_memset
#1 0x55555596a77c in string_init libiberty/d-demangle.c:105:15
#2 0x55555596a77c in dlang_function_type libiberty/d-demangle.c:699:3
#3 0x55555595cee1 in dlang_type libiberty/d-demangle.c:902:17
#4 0x55555596922e in dlang_function_args libiberty/d-demangle.c:785:17
#5 0x55555596a975 in dlang_function_type_noreturn
libiberty/d-demangle.c:675:13
#6 0x55555596a975 in dlang_function_type libiberty/d-demangle.c:703:13
#7 0x55555595cee1 in dlang_type libiberty/d-demangle.c:902:17
#8 0x55555596922e in dlang_function_args libiberty/d-demangle.c:785:17
#9 0x55555596a975 in dlang_function_type_noreturn
libiberty/d-demangle.c:675:13
#10 0x55555596a975 in dlang_function_type libiberty/d-demangle.c:703:13
#11 0x55555595cee1 in dlang_type libiberty/d-demangle.c:902:17
#12 0x55555596922e in dlang_function_args libiberty/d-demangle.c:785:17
#13 0x55555596a975 in dlang_function_type_noreturn
libiberty/d-demangle.c:675:13
#14 0x55555596a975 in dlang_function_type libiberty/d-demangle.c:703:13
#15 0x55555595cee1 in dlang_type libiberty/d-demangle.c:902:17
#16 0x55555596922e in dlang_function_args libiberty/d-demangle.c:785:17
#17 0x55555596a975 in dlang_function_type_noreturn
libiberty/d-demangle.c:675:13
...
SUMMARY: AddressSanitizer: stack-overflow in __asan_memset
==3664063==ABORTING
```
--
You are receiving this mail because:
You are on the CC list for the bug.
