binutils Newspaper
JULY 29, 2026
Date
/
Architectures
Components
Topics
News & Policy
Other
libiberty

libiberty: Fix signed integer overflow in d_compact_number

Prevents potential signed integer overflow in libiberty's demangling function by using unsigned arithmetic.

The d_compact_number function in libiberty’s C++ demangler could suffer from a signed integer overflow when calculating a number. This commit resolves the issue by performing the addition using unsigned arithmetic, preventing undefined behavior and ensuring correct demangling for certain inputs.

In Details

The d_compact_number function in libiberty/cp-demangle.c calculates a number based on a preceding digit sequence. The addition of 1 to the result of d_number(di) could overflow if d_number(di) returns the maximum representable signed integer. This commit changes the literal 1 to 1u, promoting the addition to unsigned arithmetic and thus avoiding the overflow, as reported in bug report 34324. This is a common pattern to avoid signed overflow issues in C/C++.

For Context
libiberty
A collection of general-purpose utility functions used by various GNU projects, including GCC and Binutils. It provides common services like string manipulation, symbol table handling, and demangling.
C++ demangling
The process of converting mangled C++ symbol names (which encode information about namespaces, classes, function signatures, etc.) back into human-readable forms.
signed integer overflow
A condition that occurs when an arithmetic operation on signed integers produces a result that is outside the range of values that can be represented by the integer type. In C and C++, signed integer overflow results in undefined behavior.
unsigned arithmetic
Arithmetic operations performed on unsigned integer types. Unlike signed integers, unsigned integers do not have a sign bit and use all bits to represent magnitude, allowing for a larger positive range and well-defined wrap-around behavior on overflow.
Filed Under: libibertydemanglinginteger-overflow