[libcxxabi][demangler] Fix a exponential string copying bug

[erik.pilkington]

Summary

The problem was that if base_name() was called from a context without an actual base name, it could gulp up the entire string, which can result in recursive duplications. The fix is to be more strict as to what qualifies as a base name.

Fixes PR31031
Thanks

[compnerd]

Thanks for looking into this, its been on my list for a while now.

src/cxa_demangle.cpp

2918 ↗

(On Diff #100568)

Hmm, I wonder if we should negate and hoist this into the condition rather than the explicit check here. It makes it slightly more obvious what we are trying to do here. However, it does make failing more challenging (since we cannot as easily identify if the extraction failed.

libcxxabi/trunk/src/cxa_demangle.cpp

base_name(String& s)
     const char* p0 = pe - 1;
     for (; p0 != pf; --p0)
     {
         if (*p0 == ':')
         {
             ++p0;
             break;
         }
+        if (!isalpha(*p0) && !isdigit(*p0) && *p0 != '_')
+        {
+            return String();
+        }
     }
     return String(p0, pe);
 }
 
 // <ctor-dtor-name> ::= C1    # complete object constructor
 //                  ::= C2    # base object constructor
 //                  ::= C3    # complete object allocating constructor
 //   extension      ::= C5    # ?

libcxxabi/trunk/test/test_demangle.pass.cpp

// The following test cases were found by libFuzzer+ASAN
     "\x44\x74\x70\x74\x71\x75\x32\x43\x41\x38\x65\x6E\x9B\x72\x4D\xC1\x43\x41\x72\x4D\x6E\x77\x38\x9A\x8E\x44\x6F\x64\x2C\x53\xF9\x5F\x70\x74\x70\x69\x45\xB4\xD3\x73\x9F\x2A\x37",
     "\x4C\x5A\x4C\x55\x6C\x69\x4D\x73\x72\x53\x6F\x7A\x41\x5F\x41\x67\x74\x71\x75\x32\x4D\x41\x64\x73\x39\x28\x76\x72\x4D\x34\x44\x4B\x45\x54\x6E\x61\x37\x47\x77\x78\x38\x43\x27\x41\x5F\x73\x70\x69\x45\x6F\x45\x49\x6D\x1A\x4C\x53\x38\x6A\x7A\x5A",
     "\x44\x74\x63*",
     "\x44\x74\x71\x75\x35\x2A\xDF\x74\x44\x61\x73\x63\x35\x2A\x3B\x41\x72\x4D\x6E\x65\x34\x9F\xC1\x63\x41\x72\x4D\x6E\x77\x38\x9A\x8E\x44\x6F\x64\x6C\x53\xF9\x5F\x70\x74\x70\x69\x45\x33\x44\x76\x35",
     "\x44\x74\x70\x74\x71\x75\x32\x43\x41\x38\x65\x6E\x9B\x72\x4D\xC1\x43\x41\x72\x4D\x6E\x77\x38\x9A\x8E\x44\x6F\x64\x6C\x53\xF9\x5F\x70\x74\x70\x69\x45\x38\xD3\x73\x9E\x2A\x37",
     "\x46\x44\x74\x70\x74\x71\x75\x32\x43\x41\x72\x4D\x6E\x65\x34\x9F\xC1\x43\x41\x72\x4D\x6E\x77\x38\x9A\x8E\x44\x6F\x64\x6C\x53\xF9\x5F\x70\x74\x70\x69\x45\x34\xD3\x73\x9E\x2A\x37\x72\x33\x8E\x3A\x29\x8E\x44\x35",
     "_ZcvCiIJEEDvT__FFFFT_vT_v",
     "Z1JIJ1_T_EE3o00EUlT_E0",
+    "___Z2i_D1D1D1D1D1D1D1D1D1D1D1D1D1D1D1D1D1D1D1D1D1D1D1D1D1D1D1D1D1D",
 };
 
 const unsigned NI = sizeof(invalid_cases) / sizeof(invalid_cases[0]);
 
 void test()
 {
     std::size_t len = 0;
     char* buf = nullptr;