Red Hat Bugzilla – Bug 120493
Endless loop during demangling
Last modified: 2007-11-30 17:07:01 EST
From Bugzilla Helper: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR 1.1.4322) Description of problem: This example raise error: ---------------------- #include <string.h> extern "C" char* __cxa_demangle (const char* mangled_name, char* output_buffer, size_t* length, int* status); int main () { char name [4096]; char buf [4096]; size_t n = 0; int status = 0; strcpy (name, "xFixDestroyDataBlock"); __cxa_demangle (name, buf, &n, &status); return 0; } ------------------------ There is endless loop in function __cxa_dyn_string_resize. Source: ------------------------ dyn_string_t dyn_string_resize (ds, space) dyn_string_t ds; int space; { int new_allocated = ds->allocated; /* Increase SPACE to hold the NUL termination. */ ++space; /* Increase allocation by factors of two. */ while (space > new_allocated) new_allocated *= 2; ------------------------ The value os new_allocated is 0 and execution cannot be out of while loop. Version-Release number of selected component (if applicable): libstdc++-3.2-29 How reproducible: Always Steps to Reproduce: 1. Example from description Additional info:
Your testcase is flawed, buf if not NULL must be allocated by malloc or realloc, see http://www.codesourcery.com/cxx-abi/abi.html#demangler But it loops even if the buffer is really malloced and there is another bug in that it fails when status == NULL, which it should not. Note that RHL 8.0 is no longer supported, so changing this to RHEL3.
Please try ftp://people.redhat.com/jakub/gcc/errata/3.2.3-34/
An errata has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2004-142.html