From be3004dc350a820a5b0320b34bd05673ba534058 Mon Sep 17 00:00:00 2001
From: law <law@138bc75d-0d04-0410-961f-82ee72b054a4>
Date: Thu, 31 Mar 2016 17:20:53 +0000
Subject: [PATCH] 	* cplus-dem.c (squangle_mop_up): Zero bsize/ksize
 after freeing 	btypevec/ktypevec. 	* testsuite/demangle-expected: Add
 coverage tests.

git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/trunk@234645 138bc75d-0d04-0410-961f-82ee72b054a4

Upstream-Status: Backport
CVE:  CVE-2016-4488

patched ChangeLog and demangle-expected as patch is from tip.
Signed-off-by: Armin Kuster <akuster@mvista.com>


---
 libiberty/ChangeLog                   |  7 +++++++
 libiberty/cplus-dem.c                 |  2 ++
 libiberty/testsuite/demangle-expected | 10 ++++++++++
 3 files changed, 19 insertions(+)

Index: gcc-5.3.0/libiberty/cplus-dem.c
===================================================================
--- gcc-5.3.0.orig/libiberty/cplus-dem.c
+++ gcc-5.3.0/libiberty/cplus-dem.c
@@ -1237,11 +1237,13 @@ squangle_mop_up (struct work_stuff *work
     {
       free ((char *) work -> btypevec);
       work->btypevec = NULL;
+      work->bsize = 0;
     }
   if (work -> ktypevec != NULL)
     {
       free ((char *) work -> ktypevec);
       work->ktypevec = NULL;
+      work->ksize = 0;
     }
 }
 
Index: gcc-5.3.0/libiberty/testsuite/demangle-expected
===================================================================
--- gcc-5.3.0.orig/libiberty/testsuite/demangle-expected
+++ gcc-5.3.0/libiberty/testsuite/demangle-expected
@@ -4356,3 +4356,13 @@ _QueueNotification_QueueController__$4PP
 --format=gnu-v3
 _Z1fSsB3fooS_
 f(std::string[abi:foo], std::string[abi:foo])
+#
+# Tests a use-after-free problem
+
+_Q.__0
+::Q.(void)
+#
+# Tests a use-after-free problem
+
+_Q10-__9cafebabe.
+cafebabe.::-(void)
Index: gcc-5.3.0/libiberty/ChangeLog
===================================================================
--- gcc-5.3.0.orig/libiberty/ChangeLog
+++ gcc-5.3.0/libiberty/ChangeLog
@@ -1,3 +1,10 @@
+2016-03-31  Mikhail Maltsev  <maltsevm@gmail.com>
+           Marcel Bohme  boehme.marcel@gmail.com
+
+       * cplus-dem.c (squangle_mop_up): Zero bsize/ksize after freeing
+       btypevec/ktypevec.
+       * testsuite/demangle-expected: Add coverage tests.
+
 2015-12-04  Release Manager
 
 	* GCC 5.3.0 released.