<html>
    <head>
      <base href="https://bugs.llvm.org/">
    </head>
    <body><table border="1" cellspacing="0" cellpadding="8">
        <tr>
          <th>Bug ID</th>
          <td><a class="bz_bug_link 
          bz_status_NEW "
   title="NEW - Stack-overflow in demangler (9)"
   href="https://bugs.llvm.org/show_bug.cgi?id=32887">32887</a>
          </td>
        </tr>

        <tr>
          <th>Summary</th>
          <td>Stack-overflow in demangler (9)
          </td>
        </tr>

        <tr>
          <th>Product</th>
          <td>libc++abi
          </td>
        </tr>

        <tr>
          <th>Version</th>
          <td>unspecified
          </td>
        </tr>

        <tr>
          <th>Hardware</th>
          <td>All
          </td>
        </tr>

        <tr>
          <th>OS</th>
          <td>Linux
          </td>
        </tr>

        <tr>
          <th>Status</th>
          <td>NEW
          </td>
        </tr>

        <tr>
          <th>Severity</th>
          <td>normal
          </td>
        </tr>

        <tr>
          <th>Priority</th>
          <td>P
          </td>
        </tr>

        <tr>
          <th>Component</th>
          <td>All Bugs
          </td>
        </tr>

        <tr>
          <th>Assignee</th>
          <td>unassignedbugs@nondot.org
          </td>
        </tr>

        <tr>
          <th>Reporter</th>
          <td>dungnguy@comp.nus.edu.sg
          </td>
        </tr>

        <tr>
          <th>CC</th>
          <td>llvm-bugs@lists.llvm.org, mclow.lists@gmail.com
          </td>
        </tr></table>
      <p>
        <div>
        <pre>Dear All,

This bug was found with AFLGo, a directed version of AFL/AFLFast. Thanks also
to Marcel B√∂hme and Van-Thuan Pham.

First, you need to build the project
(<a href="https://github.com/llvm-mirror/libcxxabi/blob/master/fuzz/cxa_demangle_fuzzer.cpp">https://github.com/llvm-mirror/libcxxabi/blob/master/fuzz/cxa_demangle_fuzzer.cpp</a>)
to obtain the binary file.

To reproduce:
$ printf "DTc" > test
$ for c in $(seq 1 15000); do printf "c"; done >> test; echo "" >> test; cat
test | ./cxa_demangle_fuzzer
Segmentation fault

==30298==ERROR: AddressSanitizer: stack-overflow on address 0x7ffc68347ea0 (pc
0x000000531fc2 bp 0x7ffc68349830 sp 0x7ffc68347ea0 T0)
    #0 0x531fc1 in char const* __cxxabiv1::(anonymous
namespace)::parse_type<__cxxabiv1::(anonymous namespace)::Db>(char const*, char
const*, __cxxabiv1::(anonymous namespace)::Db&)
/src/llvm_libcxxabi/src/cxa_demangle.cpp:1904
    #1 0x6deaea in char const* __cxxabiv1::(anonymous
namespace)::parse_const_cast_expr<__cxxabiv1::(anonymous namespace)::Db>(char
const*, char const*, __cxxabiv1::(anonymous namespace)::Db&)
/src/llvm_libcxxabi/src/cxa_demangle.cpp:617:25
    #2 0x6deaea in char const* __cxxabiv1::(anonymous
namespace)::parse_expression<__cxxabiv1::(anonymous namespace)::Db>(char
const*, char const*, __cxxabiv1::(anonymous namespace)::Db&)
/src/llvm_libcxxabi/src/cxa_demangle.cpp:3382
    #3 0x6deb27 in char const* __cxxabiv1::(anonymous
namespace)::parse_const_cast_expr<__cxxabiv1::(anonymous namespace)::Db>(char
const*, char const*, __cxxabiv1::(anonymous namespace)::Db&)
/src/llvm_libcxxabi/src/cxa_demangle.cpp:620:30
    #4 0x6deb27 in char const* __cxxabiv1::(anonymous
namespace)::parse_expression<__cxxabiv1::(anonymous namespace)::Db>(char
const*, char const*, __cxxabiv1::(anonymous namespace)::Db&)
/src/llvm_libcxxabi/src/cxa_demangle.cpp:3382
    #5 0x6deb27 in char const* __cxxabiv1::(anonymous
namespace)::parse_const_cast_expr<__cxxabiv1::(anonymous namespace)::Db>(char
const*, char const*, __cxxabiv1::(anonymous namespace)::Db&)
/src/llvm_libcxxabi/src/cxa_demangle.cpp:620:30
    #6 0x6deb27 in char const* __cxxabiv1::(anonymous
namespace)::parse_expression<__cxxabiv1::(anonymous namespace)::Db>(char
const*, char const*, __cxxabiv1::(anonymous namespace)::Db&)
/src/llvm_libcxxabi/src/cxa_demangle.cpp:3382
    ...

Regards,
Manh-Dung Nguyen</pre>
        </div>
      </p>


      <hr>
      <span>You are receiving this mail because:</span>

      <ul>
          <li>You are on the CC list for the bug.</li>
      </ul>
    </body>
</html>