<html>
<body>
<script type="application/ld+json">
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"potentialAction": {
"@type": "ViewAction",
"name": "View Issue",
"url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14201"
},
"description": ""
}
</script>
<div style="font-family: arial, sans-serif; white-space:pre"><br/>Comment #4 on issue 14201 by <a href="mailto:thakis@chromium.org">thakis@chromium.org</a>: llvm/llvm-microsoft-demangle-fuzzer: Stack-overflow in llvm::ms_demangle::Demangler::demangleTemplateInstantiationName<br/><a href="https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14201#c4">https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14201#c4</a><br/><br/>The issue here is that demangleTemplateInstantiationName keeps a BackrefContext on the stack, and that is 22 pointers large. So stack_size / 176 is the max number of template instantiation names that work.<br/><br/>The report "only" has 57 calls to demangleTemplateInstantiationName on the stack, which is only 10kB large. Maybe oss-fuzz runs with a small stack ulimit?<br/><br/>Moving BackrefContext to the heap would probably extend the runway until this happens a lot, but it'd still happen eventually and in practice even 57 calls is very far away from what realistic inputs will have. So I'm not sure anything needs to be done here.<br/><br/>-- <br/>You received this message because:<br/> 1. You were specifically CC'd on the issue<br/><br/>You may adjust your notification preferences at:<br/><a href="https://bugs.chromium.org/hosting/settings">https://bugs.chromium.org/hosting/settings</a><br/><br/>Reply to this email to add a comment.</div>
</body>
</html>