libiberty d_compact_number signed integer overflow
Fixes signed integer overflow in `libiberty`'s C++ demangler.
This patch addresses a signed integer overflow vulnerability in the d_compact_number function within libiberty/cp-demangle.c. The overflow occurs during the addition of 1 to a number obtained from d_number. The fix converts this addition to use unsigned arithmetic (+ 1u), preventing the overflow and ensuring correct behavior for the C++ demangler.
- proposer
Submits a fix for a signed integer overflow in `libiberty's` C++ demangler, applying it to binutils and gcc.
“Fix this by doing the addition in unsigned arithmetic. Applying to binutils and gcc as obvious.”
In Details
A signed integer overflow vulnerability in libiberty/cp-demangle.c's d_compact_number function is addressed by switching the addition of 1 to unsigned arithmetic (+ 1u). This prevents the overflow that could occur when d_number() returns a value close to the maximum for a signed integer, ensuring the demangler operates correctly and securely under all valid input conditions.
- libiberty
- A collection of utility functions used by GCC and other GNU projects, providing common routines like string manipulation, memory allocation, and demangling.
- C++ demangler
- A tool that converts mangled C++ symbol names (which are made unreadable by the compiler for C++ name mangling) back into their original, human-readable form.
- signed integer overflow
- An error condition that occurs when an arithmetic operation attempts to create a value that is too large to be represented by a signed integer type. This can lead to unexpected behavior and security vulnerabilities.
- unsigned arithmetic
- Arithmetic operations performed on integer types that do not use the most significant bit to represent the sign. This allows for a larger positive range compared to signed integers of the same size.
- compiler
- A program that translates source code written in a high-level programming language into a lower-level language, such as machine code or an intermediate representation.