Skip to content

Commit 2fe8a07

Browse files
committed
Fix null terminator in Demangle function.
If the demangled name is longer than out_size, the null terminator is missing from the output. This will cause a crash in the DemangleInplace() function (symbolize.cc) when calling strlen on the buffer.
1 parent 2075ae8 commit 2fe8a07

File tree

2 files changed

+37
-0
lines changed

2 files changed

+37
-0
lines changed

src/demangle.cc

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1351,6 +1351,9 @@ bool Demangle(const char* mangled, char* out, size_t out_size) {
13511351
}
13521352

13531353
std::copy_n(unmangled.get(), std::min(n, out_size), out);
1354+
if(n > out_size) {
1355+
out[out_size-1] = '\0';
1356+
}
13541357
return status == 0;
13551358
#else
13561359
State state;

src/symbolize_unittest.cc

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,9 @@
3535

3636
#include <csignal>
3737
#include <iostream>
38+
#include <map>
39+
#include <string>
40+
3841

3942
#include "config.h"
4043
#include "glog/logging.h"
@@ -133,6 +136,18 @@ TEST(Symbolize, Symbolize) {
133136

134137
struct Foo {
135138
static void func(int x);
139+
static void longParamFunc(
140+
std::map<std::map<std::string, std::string>,std::map<std::string, std::string> > p0,
141+
std::map<std::map<std::string, std::string>,std::map<std::string, std::string> > p1,
142+
std::map<std::map<std::string, std::string>,std::map<std::string, std::string> > p2,
143+
std::map<std::map<std::string, std::string>,std::map<std::string, std::string> > p3,
144+
std::map<std::map<std::string, std::string>,std::map<std::string, std::string> > p4,
145+
std::map<std::map<std::string, std::string>,std::map<std::string, std::string> > p5,
146+
std::map<std::map<std::string, std::string>,std::map<std::string, std::string> > p6,
147+
std::map<std::map<std::string, std::string>,std::map<std::string, std::string> > p7,
148+
std::map<std::map<std::string, std::string>,std::map<std::string, std::string> > p8,
149+
std::map<std::map<std::string, std::string>,std::map<std::string, std::string> > p9
150+
);
136151
};
137152

138153
void ATTRIBUTE_NOINLINE Foo::func(int x) {
@@ -142,6 +157,22 @@ void ATTRIBUTE_NOINLINE Foo::func(int x) {
142157
a = a + 1;
143158
}
144159

160+
void ATTRIBUTE_NOINLINE Foo::longParamFunc(
161+
std::map<std::map<std::string, std::string>,std::map<std::string, std::string> > p0,
162+
std::map<std::map<std::string, std::string>,std::map<std::string, std::string> > p1,
163+
std::map<std::map<std::string, std::string>,std::map<std::string, std::string> > p2,
164+
std::map<std::map<std::string, std::string>,std::map<std::string, std::string> > p3,
165+
std::map<std::map<std::string, std::string>,std::map<std::string, std::string> > p4,
166+
std::map<std::map<std::string, std::string>,std::map<std::string, std::string> > p5,
167+
std::map<std::map<std::string, std::string>,std::map<std::string, std::string> > p6,
168+
std::map<std::map<std::string, std::string>,std::map<std::string, std::string> > p7,
169+
std::map<std::map<std::string, std::string>,std::map<std::string, std::string> > p8,
170+
std::map<std::map<std::string, std::string>,std::map<std::string, std::string> > p9
171+
) {
172+
volatile auto a = p0.size() + p1.size() + p2.size() + p3.size() + p4.size() + p5.size() + p6.size() + p7.size() + p8.size() + p9.size();
173+
a = a + 1;
174+
}
175+
145176
// With a modern GCC, Symbolize() should return demangled symbol
146177
// names. Function parameters should be omitted.
147178
# ifdef TEST_WITH_MODERN_GCC
@@ -150,6 +181,9 @@ TEST(Symbolize, SymbolizeWithDemangling) {
150181
# if !defined(_MSC_VER) || !defined(NDEBUG)
151182
# if defined(HAVE___CXA_DEMANGLE)
152183
EXPECT_STREQ("Foo::func(int)", TrySymbolize((void*)(&Foo::func)));
184+
// Very long functions can be truncated, but we should not crash or return null
185+
// Also the result should start properly.
186+
EXPECT_TRUE(0 == std::string( TrySymbolize( (void*)(&Foo::longParamFunc))).find("Foo::longParamFunc("));
153187
# else
154188
EXPECT_STREQ("Foo::func()", TrySymbolize((void*)(&Foo::func)));
155189
# endif

0 commit comments

Comments
 (0)