Bug#840889: diff NMU for libiberty_20161011-1.1
tags 840889 +pending
thanks
Dear maintainer,
I have prepared an NMU (versioned as 20161011-1.1) and
uploaded to DELAYED/10.
Please fell free to tell me if I should delay it longer, cancel
or reschedule. Diff is attached.
Best regards
Anton
diff -Nru libiberty-20161011/debian/changelog libiberty-20161011/debian/changelog
--- libiberty-20161011/debian/changelog 2016-10-11 09:14:23.000000000 +0200
+++ libiberty-20161011/debian/changelog 2016-10-15 21:14:05.000000000 +0200
@@ -1,3 +1,11 @@
+libiberty (20161011-1.1) unstable; urgency=medium
+
+ * Non-maintainer upload.
+ * Fix not included into upstream release fixes for
+ CVE-2016-4491 and CVE-2016-6131. Closes: #840889
+
+ -- Anton Gladky <gladk@debian.org> Sat, 15 Oct 2016 21:01:33 +0200
+
libiberty (20161011-1) unstable; urgency=medium
* Update to 20161011 (security issues fixed: CVE-2016-6131, CVE-2016-4493,
diff -Nru libiberty-20161011/debian/patches/0001-CVE-2016-4491.patch libiberty-20161011/debian/patches/0001-CVE-2016-4491.patch
--- libiberty-20161011/debian/patches/0001-CVE-2016-4491.patch 1970-01-01 01:00:00.000000000 +0100
+++ libiberty-20161011/debian/patches/0001-CVE-2016-4491.patch 2016-10-15 21:01:09.000000000 +0200
@@ -0,0 +1,117 @@
+Description: Fix Libiberty Demangler segfaults. CVE-2016-4491
+Author: Marcel Böhme <boehme.marcel@gmail.com>
+Origin: https://gcc.gnu.org/ml/gcc-patches/2016-05/msg00105.html
+Acked-by: Anton Gladky <gladk@debian.org>
+Last-Update: 2016-10-15
+
+---
+ libiberty/cp-demangle.c | 18 ++++++++++
+ libiberty/testsuite/demangle-expected | 66 +++++++++++++++++++++++++++++++++++
+ 2 files changed, 84 insertions(+)
+
+diff --git a/libiberty/cp-demangle.c b/libiberty/cp-demangle.c
+index 0c6d714..e118985 100644
+--- a/libiberty/cp-demangle.c
++++ b/libiberty/cp-demangle.c
+@@ -5587,6 +5587,24 @@ d_print_comp (struct d_print_info *dpi, int options,
+ {
+ struct d_component_stack self;
+
++ self.parent = dpi->component_stack;
++
++ while (self.parent)
++ {
++ self.dc = self.parent->dc;
++ self.parent = self.parent->parent;
++ if (dc != NULL && self.dc == dc)
++ {
++ while (self.parent)
++ {
++ self.dc = self.parent->dc;
++ self.parent = self.parent->parent;
++ if (self.dc == dc)
++ return;
++ }
++ }
++ }
++
+ self.dc = dc;
+ self.parent = dpi->component_stack;
+ dpi->component_stack = &self;
+diff --git a/libiberty/testsuite/demangle-expected b/libiberty/testsuite/demangle-expected
+index 535f2c1..c3e2669 100644
+--- a/libiberty/testsuite/demangle-expected
++++ b/libiberty/testsuite/demangle-expected
+@@ -4587,3 +4587,69 @@ _Z80800000000000000000000
+
+ __t2m05B500000000000000000_
+ __t2m05B500000000000000000_
++#
++# Test demangler crash PR62279
++
++_ZN5Utils9transformIPN15ProjectExplorer13BuildStepListEZNKS1_18BuildConfiguration14knownStepListsEvEUlS3_E_EE5QListIDTclfp0_cvT__EEEERKS6_IS7_ET0_
++QList<decltype ({parm#2}((ProjectExplorer::BuildStepList*)()))> Utils::transform<ProjectExplorer::BuildStepList*, ProjectExplorer::BuildConfiguration::knownStepLists() const::{lambda(ProjectExplorer::BuildStepList*)#1}>(ProjectExplorer::BuildConfiguration::knownStepLists() const::{lambda(ProjectExplorer::BuildStepList*)#1}<QList> const&, ProjectExplorer::BuildConfiguration::knownStepLists() const::{lambda(ProjectExplorer::BuildStepList*)#1})
++#
++
++_ZSt7forwardIKSaINSt6thread5_ImplISt12_Bind_simpleIFZN6WIM_DL5Utils9AsyncTaskC4IMNS3_8Hardware12FpgaWatchdogEKFvvEIPS8_EEEibOT_DpOT0_EUlvE_vEEEEEESD_RNSt16remove_referenceISC_E4typeE
++std::allocator<std::thread::_Impl<std::_Bind_simple<WIM_DL::Utils::AsyncTask::AsyncTask<void (WIM_DL::Hardware::FpgaWatchdog::*)() const, WIM_DL::Hardware::FpgaWatchdog*>(int, bool, void (WIM_DL::Hardware::FpgaWatchdog::*&&)() const, WIM_DL::Hardware::FpgaWatchdog*&&)::{lambda()#1} ()> > > const&& std::forward<std::allocator<std::thread::_Impl<std::_Bind_simple<WIM_DL::Utils::AsyncTask::AsyncTask<void (WIM_DL::Hardware::FpgaWatchdog::*)() const, WIM_DL::Hardware::FpgaWatchdog*>(int, bool, std::allocator<std::thread::_Impl<std::_Bind_simple<WIM_DL::Utils::AsyncTask::AsyncTask<void (WIM_DL::Hardware::FpgaWatchdog::*)() const, WIM_DL::Hardware::FpgaWatchdog*>(int, bool, void (WIM_DL::Hardware::FpgaWatchdog::*&&)() const, WIM_DL::Hardware::FpgaWatchdog*&&)::{lambda()#1} ()> > > const&&, WIM_DL::Hardware::FpgaWatchdog*&&)::{lambda()#1} ()> > > const>(std::remove_reference<std::allocator<std::thread::_Impl<std::_Bind_simple<WIM_DL::Utils::AsyncTask::AsyncTask<void (WIM_DL::Hardware::FpgaWatchdog::*)() const, WIM_DL::Hardware::FpgaWatchdog*>(int, bool, void (WIM_DL::Hardware::FpgaWatchdog::*&&)() const, WIM_DL::Hardware::FpgaWatchdog*&&)::{lambda()#1} ()> > > const>::type&)
++#
++# Test demangler crash PR61805
++
++_ZNK5niven5ColorIfLi4EEdvIfEENSt9enable_ifIXsrSt13is_arithmeticIT_E5valueEKNS0_IDTmlcvS5__Ecvf_EELi4EEEE4typeES5_
++std::enable_if<std::is_arithmetic<float>::value, niven::Color<decltype (((float)())*((float)())), 4> const>::type niven::Color<float, 4>::operator/<float>(float) const
++#
++# Test recursion PR70517
++
++_ZSt4moveIRZN11tconcurrent6futureIvE4thenIZ5awaitIS2_EDaOT_EUlRKS6_E_EENS1_INSt5decayIDTclfp_defpTEEE4typeEEES7_EUlvE_EONSt16remove_referenceIS6_E4typeES7_
++std::remove_reference<tconcurrent::future<std::decay<decltype ({parm#1}(*this))>::type> tconcurrent::future<void>::then<auto await<tconcurrent::future<void> >(tconcurrent::future<void>&&)::{lambda(tconcurrent::future<std::decay<decltype ({parm#1}(*this))>::type> tconcurrent::future<void>::then<auto await<tconcurrent::future<void> >()::{lambda( const&)#1}>( const)::{lambda()#1}& const&)#1}>(auto await<tconcurrent::future<void> >()::{lambda( const&)#1}&& const)::{lambda()#1}&>::type&& std::move<tconcurrent::future<std::decay<decltype ({parm#1}(*this))>::type> tconcurrent::future<void>::then<auto await<tconcurrent::future<void> >(tconcurrent::future<std::decay<decltype ({parm#1}(*this))>::type> tconcurrent::future<void>::then<auto await<tconcurrent::future<void> >(tconcurrent::future<void>&&)::{lambda(& const&)#1}>(auto await<tconcurrent::future<void> >()::{lambda( const&)#1}&& const)::{lambda()#1}&)::{lambda(tconcurrent::future<std::decay<decltype ({parm#1}(*this))>::type> tconcurrent::future<void>::then<auto await<tconcurrent::future<void> >(tconcurrent::future<void>&&)::{lambda(& const&)#1}>(auto await<tconcurrent::future<void> >()::{lambda(&)#1}&& const)::{lambda()#1}& const&)#1}>(tconcurrent::future<std::decay<decltype ({parm#1}(*this))>::type> tconcurrent::future<void>::then<auto await<tconcurrent::future<void> >(tconcurrent::future<void>&&)::{lambda(& const&)#1}>(auto await<tconcurrent::future<void> >()::{lambda(&)#1}&& const)::{lambda()#1}& const)::{lambda()#1}&>(tconcurrent::future<std::decay<decltype ({parm#1}(*this))>::type> tconcurrent::future<void>::then<auto await<tconcurrent::future<void> >(tconcurrent::future<void>&&)::{lambda(tconcurrent::future<std::decay<decltype ({parm#1}(*this))>::type> tconcurrent::future<void>::then<auto await<tconcurrent::future<void> >()::{lambda(&)#1}>()::{lambda()#1}& const&)#1}>(auto await<tconcurrent::future<void> >()::{lambda(&)#1}&& const)::{lambda()#1}& const)
++#
++# Test recursion PR68383
++
++_ZSt7forwardIRKZN5Write14DataMapGrammarISt20back_insert_iteratorISsEEC4EvEUlRT_E_EOS5_RNSt16remove_referenceIS5_E4typeE
++_ZSt7forwardIRKZN5Write14DataMapGrammarISt20back_insert_iteratorISsEEC4EvEUlRT_E_EOS5_RNSt16remove_referenceIS5_E4typeE
++#
++# Test recursion PR67264
++
++_Z1KIStcvT_E
++K<std::operator std::operator >
++
++_ZcvT_IIS0_EE
++operator operator <operator operator >
++
++_ZcvT_IZcvT_E1fE
++operator operator operator ::f::f<operator operator ::f::f>
++
++_Z1gINcvT_EE
++g<operator operator >
++
++_ZcvT_ILZcvDTT_EEE
++operator operator decltype (operator decltype ())<operator decltype (operator decltype ())>
++
++_Z1gIJOOT_EEOT_c
++_Z1gIJOOT_EEOT_c
++
++_Z1KMMMMMMMMMMMMMMMA_xooooooooooooooo
++K(unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 long long (long long (unsigned __int128 ::*::* unsigned __int128 unsigned __int128 ::*::*::* unsigned __int128 unsigned __int128 unsigned __int128 ::*::*::*::* unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 ::*::*::*::*::* unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 ::*::*::*::*::*::* unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 ::*::*::*::*::*::*::* unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 ::*::*::*::*::*::*::*::* unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 ::*::*::*::*::*::*::*::*::* unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 ::*::*::*::*::*::*::*::*::*::* unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 ::*::*::*::*::*::*::*::*::*::*::* unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 ::*::*::*::*::*::*::*::*::*::*::*::* unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 ::*::*::*::*::*::*::*::*::*::*::*::*::* unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 ::*::*::*::*::*::*::*::*::*::*::*::*::*::* unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 unsigned __int128 ::*::*::*::*::*::*::*::*::*::*::*::*::*::*::*) []::*) []::*::*::*::*::*::*::*::*::*::*::*::*::*::*::*)
++
++_ZdvMMMMMMMMMMMMMrrrrA_DTdvfp_fp_Eededilfdfdfdfd
++operator/(float double float double float double float long int double long double double long double decltype ({parm#1}/{parm#1}) restrict (decltype ({parm#1}/{parm#1}) restrict (long double ::*::* double long double ::*::*::* long double double long double ::*::*::*::* double long double double long double ::*::*::*::*::* int double long double double long double ::*::*::*::*::*::* long int double long double double long double ::*::*::*::*::*::*::* float long int double long double double long double ::*::*::*::*::*::*::*::* double float long int double long double double long double ::*::*::*::*::*::*::*::*::* float double float long int double long double double long double ::*::*::*::*::*::*::*::*::*::* double float double float long int double long double double long double ::*::*::*::*::*::*::*::*::*::*::* float double float double float long int double long double double long double ::*::*::*::*::*::*::*::*::*::*::*::* double float double float double float long int double long double double long double ::*::*::*::*::*::*::*::*::*::*::*::*::*) []::*) []::*::*::*::*::*::*::*::*::*::*::*::*::*, double)
++#
++# Test for Infinite Recursion PR67738
++
++_ZNK6Common15ConvertingRangeIN5boost12range_detail17transformed_rangeIZN1a1b1cEbEUljE_KSt6vectorIjSaIjEEEEEcvT_IS7_INS4_1dESaISF_EEEEv
++Common::ConvertingRange<boost::range_detail::transformed_range<a::b::c(bool)::{lambda(unsigned int)#1}, std::vector<unsigned int, std::allocator<unsigned int> > const> >::operator a::b::c(bool)::{lambda(unsigned int)#1}<a::d, std::allocator<Common::ConvertingRange<boost::range_detail::transformed_range<a::b::c(bool)::{lambda(unsigned int)#1}, std::vector<unsigned int, std::allocator<unsigned int> > const> >::operator > ><a::b::c(bool)::{lambda(unsigned int)#1}<a::d, std::allocator<Common::ConvertingRange<boost::range_detail::transformed_range<a::b::c(bool)::{lambda(unsigned int)#1}, std::vector<unsigned int, std::allocator<unsigned int> > const> >::operator Common::ConvertingRange<boost::range_detail::transformed_range<a::b::c(bool)::{lambda(unsigned int)#1}, std::vector<unsigned int, std::allocator<unsigned int> > const> >::operator > > >() const
++#
++# Test for Infinite Recursion PR68700
++
++_ZN8futurizeI13frozen_schemaE5applyIRZN7seastar7shardedIN7service13storage_proxyEE9invoke_onIZZNS6_22init_messaging_serviceEvENKUljN5utils4UUIDEE8_clEjSA_EUlOT_E_6futureIJS0_EEEET0_jSD_EUlvE_JEEESG_SD_DpOT0_
++_ZN8futurizeI13frozen_schemaE5applyIRZN7seastar7shardedIN7service13storage_proxyEE9invoke_onIZZNS6_22init_messaging_serviceEvENKUljN5utils4UUIDEE8_clEjSA_EUlOT_E_6futureIJS0_EEEET0_jSD_EUlvE_JEEESG_SD_DpOT0_
++#
++# Test for Infinite Recursion PR61460
++
++_ZNK6clover6detail11basic_rangeINS_13adaptor_rangeINS_9addressesEINS2_IRFRNS_5eventEP9_cl_eventEINS_14iterator_rangeIPKS7_EEEEEEEENS0_16iterator_adaptorIS3_INSG_IS9_ISC_EEEEEESI_EcvT_ISt6vectorIPS4_SaISN_EEvEEv
++clover::detail::basic_range<clover::adaptor_range<clover::addresses, clover::adaptor_range<clover::event& (&)(_cl_event*), clover::iterator_range<_cl_event* const*> > >, clover::detail::iterator_adaptor<clover::addresses<clover::detail::iterator_adaptor<clover::event& (&)(_cl_event*)<_cl_event* const*> > > >, clover::detail::iterator_adaptor<clover::event& (&)(_cl_event*)<_cl_event* const*> > >::operator std::vector<clover::event*, std::allocator<clover::detail::basic_range<clover::adaptor_range<clover::addresses, clover::adaptor_range<clover::event& (&)(_cl_event*), clover::iterator_range<_cl_event* const*> > >, clover::detail::iterator_adaptor<clover::addresses<clover::detail::iterator_adaptor<clover::event& (&)(_cl_event*)<_cl_event* const*> > > >, clover::detail::iterator_adaptor<clover::event& (&)(_cl_event*)<_cl_event* const*> > >::operator > ><std::vector<clover::event*, std::allocator<clover::detail::basic_range<clover::adaptor_range<clover::addresses, clover::adaptor_range<clover::event& (&)(_cl_event*), clover::iterator_range<_cl_event* const*> > >, clover::detail::iterator_adaptor<clover::addresses<clover::detail::iterator_adaptor<clover::event& (&)(_cl_event*)<_cl_event* const*> > > >, clover::detail::iterator_adaptor<clover::event& (&)(_cl_event*)<_cl_event* const*> > >::operator clover::detail::basic_range<clover::adaptor_range<clover::addresses, clover::adaptor_range<clover::event& (&)(_cl_event*), clover::iterator_range<_cl_event* const*> > >, clover::detail::iterator_adaptor<clover::addresses<clover::detail::iterator_adaptor<clover::event& (&)(_cl_event*)<_cl_event* const*> > > >, clover::detail::iterator_adaptor<clover::event& (&)(_cl_event*)<_cl_event* const*> > >::operator > >, void>() const
++
+--
+2.9.3
+
diff -Nru libiberty-20161011/debian/patches/0002-CVE-2016-6131.patch libiberty-20161011/debian/patches/0002-CVE-2016-6131.patch
--- libiberty-20161011/debian/patches/0002-CVE-2016-6131.patch 1970-01-01 01:00:00.000000000 +0100
+++ libiberty-20161011/debian/patches/0002-CVE-2016-6131.patch 2016-10-15 21:01:23.000000000 +0200
@@ -0,0 +1,188 @@
+Description: Fix Libiberty Demangler segfaults. CVE-2016-6131
+Author: Marcel Böhme <boehme.marcel@gmail.com>
+Origin: https://gcc.gnu.org/viewcvs/gcc?view=revision&revision=239143
+Origin: https://github.com/gcc-mirror/gcc/commit/ebcc31144416b524ea556708c32304c53b439724
+Acked-By: Anton Gladky <gladk@debian.org>
+Last-Update: 2016-10-15
+
+
+---
+ libiberty/cplus-dem.c | 80 ++++++++++++++++++++++++++++++++---
+ libiberty/testsuite/demangle-expected | 4 ++
+ 2 files changed, 78 insertions(+), 6 deletions(-)
+
+diff --git a/libiberty/cplus-dem.c b/libiberty/cplus-dem.c
+index 3ee2df1..f954050 100644
+--- a/libiberty/cplus-dem.c
++++ b/libiberty/cplus-dem.c
+@@ -144,6 +144,9 @@ struct work_stuff
+ string* previous_argument; /* The last function argument demangled. */
+ int nrepeats; /* The number of times to repeat the previous
+ argument. */
++ int *proctypevec; /* Indices of currently processed remembered typevecs. */
++ int proctypevec_size;
++ int nproctypes;
+ };
+
+ #define PRINT_ANSI_QUALIFIERS (work -> options & DMGL_ANSI)
+@@ -436,6 +439,10 @@ iterate_demangle_function (struct work_stuff *,
+
+ static void remember_type (struct work_stuff *, const char *, int);
+
++static void push_processed_type (struct work_stuff *, int);
++
++static void pop_processed_type (struct work_stuff *);
++
+ static void remember_Btype (struct work_stuff *, const char *, int, int);
+
+ static int register_Btype (struct work_stuff *);
+@@ -1302,6 +1309,10 @@ work_stuff_copy_to_from (struct work_stuff *to, struct work_stuff *from)
+ memcpy (to->btypevec[i], from->btypevec[i], len);
+ }
+
++ if (from->proctypevec)
++ to->proctypevec =
++ XDUPVEC (int, from->proctypevec, from->proctypevec_size);
++
+ if (from->ntmpl_args)
+ to->tmpl_argvec = XNEWVEC (char *, from->ntmpl_args);
+
+@@ -1330,11 +1341,17 @@ delete_non_B_K_work_stuff (struct work_stuff *work)
+ /* Discard the remembered types, if any. */
+
+ forget_types (work);
+- if (work -> typevec != NULL)
++ if (work->typevec != NULL)
+ {
+- free ((char *) work -> typevec);
+- work -> typevec = NULL;
+- work -> typevec_size = 0;
++ free ((char *) work->typevec);
++ work->typevec = NULL;
++ work->typevec_size = 0;
++ }
++ if (work->proctypevec != NULL)
++ {
++ free (work->proctypevec);
++ work->proctypevec = NULL;
++ work->proctypevec_size = 0;
+ }
+ if (work->tmpl_argvec)
+ {
+@@ -3555,6 +3572,8 @@ static int
+ do_type (struct work_stuff *work, const char **mangled, string *result)
+ {
+ int n;
++ int i;
++ int is_proctypevec;
+ int done;
+ int success;
+ string decl;
+@@ -3567,6 +3586,7 @@ do_type (struct work_stuff *work, const char **mangled, string *result)
+
+ done = 0;
+ success = 1;
++ is_proctypevec = 0;
+ while (success && !done)
+ {
+ int member;
+@@ -3627,8 +3647,15 @@ do_type (struct work_stuff *work, const char **mangled, string *result)
+ success = 0;
+ }
+ else
+- {
+- remembered_type = work -> typevec[n];
++ for (i = 0; i < work->nproctypes; i++)
++ if (work -> proctypevec [i] == n)
++ success = 0;
++
++ if (success)
++ {
++ is_proctypevec = 1;
++ push_processed_type (work, n);
++ remembered_type = work->typevec[n];
+ mangled = &remembered_type;
+ }
+ break;
+@@ -3850,6 +3877,9 @@ do_type (struct work_stuff *work, const char **mangled, string *result)
+ string_delete (result);
+ string_delete (&decl);
+
++ if (is_proctypevec)
++ pop_processed_type (work);
++
+ if (success)
+ /* Assume an integral type, if we're not sure. */
+ return (int) ((tk == tk_none) ? tk_integral : tk);
+@@ -4263,6 +4293,41 @@ do_arg (struct work_stuff *work, const char **mangled, string *result)
+ }
+
+ static void
++push_processed_type (struct work_stuff *work, int typevec_index)
++{
++ if (work->nproctypes >= work->proctypevec_size)
++ {
++ if (!work->proctypevec_size)
++ {
++ work->proctypevec_size = 4;
++ work->proctypevec = XNEWVEC (int, work->proctypevec_size);
++ }
++ else
++ {
++ if (work->proctypevec_size < 16)
++ /* Double when small. */
++ work->proctypevec_size *= 2;
++ else
++ {
++ /* Grow slower when large. */
++ if (work->proctypevec_size > (INT_MAX / 3) * 2)
++ xmalloc_failed (INT_MAX);
++ work->proctypevec_size = (work->proctypevec_size * 3 / 2);
++ }
++ work->proctypevec
++ = XRESIZEVEC (int, work->proctypevec, work->proctypevec_size);
++ }
++ }
++ work->proctypevec [work->nproctypes++] = typevec_index;
++}
++
++static void
++pop_processed_type (struct work_stuff *work)
++{
++ work->nproctypes--;
++}
++
++static void
+ remember_type (struct work_stuff *work, const char *start, int len)
+ {
+ char *tem;
+@@ -4526,10 +4591,13 @@ demangle_args (struct work_stuff *work, const char **mangled,
+ {
+ string_append (declp, ", ");
+ }
++ push_processed_type (work, t);
+ if (!do_arg (work, &tem, &arg))
+ {
++ pop_processed_type (work);
+ return (0);
+ }
++ pop_processed_type (work);
+ if (PRINT_ARG_TYPES)
+ {
+ string_appends (declp, &arg);
+diff --git a/libiberty/testsuite/demangle-expected b/libiberty/testsuite/demangle-expected
+index c3e2669..f3ad748 100644
+--- a/libiberty/testsuite/demangle-expected
++++ b/libiberty/testsuite/demangle-expected
+@@ -4652,4 +4652,8 @@ _ZN8futurizeI13frozen_schemaE5applyIRZN7seastar7shardedIN7service13storage_proxy
+
+ _ZNK6clover6detail11basic_rangeINS_13adaptor_rangeINS_9addressesEINS2_IRFRNS_5eventEP9_cl_eventEINS_14iterator_rangeIPKS7_EEEEEEEENS0_16iterator_adaptorIS3_INSG_IS9_ISC_EEEEEESI_EcvT_ISt6vectorIPS4_SaISN_EEvEEv
+ clover::detail::basic_range<clover::adaptor_range<clover::addresses, clover::adaptor_range<clover::event& (&)(_cl_event*), clover::iterator_range<_cl_event* const*> > >, clover::detail::iterator_adaptor<clover::addresses<clover::detail::iterator_adaptor<clover::event& (&)(_cl_event*)<_cl_event* const*> > > >, clover::detail::iterator_adaptor<clover::event& (&)(_cl_event*)<_cl_event* const*> > >::operator std::vector<clover::event*, std::allocator<clover::detail::basic_range<clover::adaptor_range<clover::addresses, clover::adaptor_range<clover::event& (&)(_cl_event*), clover::iterator_range<_cl_event* const*> > >, clover::detail::iterator_adaptor<clover::addresses<clover::detail::iterator_adaptor<clover::event& (&)(_cl_event*)<_cl_event* const*> > > >, clover::detail::iterator_adaptor<clover::event& (&)(_cl_event*)<_cl_event* const*> > >::operator > ><std::vector<clover::event*, std::allocator<clover::detail::basic_range<clover::adaptor_range<clover::addresses, clover::adaptor_range<clover::event& (&)(_cl_event*), clover::iterator_range<_cl_event* const*> > >, clover::detail::iterator_adaptor<clover::addresses<clover::detail::iterator_adaptor<clover::event& (&)(_cl_event*)<_cl_event* const*> > > >, clover::detail::iterator_adaptor<clover::event& (&)(_cl_event*)<_cl_event* const*> > >::operator clover::detail::basic_range<clover::adaptor_range<clover::addresses, clover::adaptor_range<clover::event& (&)(_cl_event*), clover::iterator_range<_cl_event* const*> > >, clover::detail::iterator_adaptor<clover::addresses<clover::detail::iterator_adaptor<clover::event& (&)(_cl_event*)<_cl_event* const*> > > >, clover::detail::iterator_adaptor<clover::event& (&)(_cl_event*)<_cl_event* const*> > >::operator > >, void>() const
++#
++# Tests stack overflow PR71696
+
++__10%0__S4_0T0T0
++%0<>::%0(%0<>)
+--
+2.9.3
+
diff -Nru libiberty-20161011/debian/patches/series libiberty-20161011/debian/patches/series
--- libiberty-20161011/debian/patches/series 2014-10-14 14:27:18.000000000 +0200
+++ libiberty-20161011/debian/patches/series 2016-10-11 09:14:23.000000000 +0200
@@ -1 +1,3 @@
use-ldflags.diff
+0001-CVE-2016-4491.patch
+0002-CVE-2016-6131.patch
Reply to: