[Bug binutils/25180] Slowness in cplus_demangle()

[tim.ruehsen at gmx dot de]

https://sourceware.org/bugzilla/show_bug.cgi?id=25180

--- Comment #4 from Tim Rühsen <tim.ruehsen at gmx dot de> ---
(In reply to Nick Clifton from comment #3)
> The cause of the problem is basically due to the recursive nature of name
> mangling, and there is nothing that can be done about this.  But there is a
> built-in recursion limit in the demangling code which is intended to catch
> cases like this one.  It is controlled by the value of
> DEMANGLE_RECURSION_LIMIT which is defined in demangle.h.  Currently this
> value is set to 2048, which was chosen because it does not break any of the
> existing demangling tests.  But in theory itcould be smaller.
> 
> For example, if you change the value 20 and rebuild, then your test case
> returns in less than one second.  (The string is not demangled, because the
> limiter just stops the operation of the library function, but cpu resources
> are not hogged either).
> 
> I did try changing the value to 1024, but this allowed the test case to have
> its slow down effect, and it is already known that 1024 prevents some real
> world name demangling from working, so it looks like there is no easy cure
> for this
> particular test.  (I did consider making the limit definable via a command
> line option, but this would involve a lot of changes to the libiberty
> library and the tools that use it, and in the end an attacker would just
> disable it).
> 
> So I am sorry, but I think that in this case there is nothing that we can do.

I already took a quick look at the weekend - the recursion depth toggled
between 73,74,75 again and again. It looked like an endless loop but after a
few millions (?) operations, it finally came to an end.

Possibly the recursion counter can be moved, so that it increments at the
beginning of the recursive function and decrements when it returns.

I'll try to find some time in the next days to investigate further. I would add
a comment in case I find a proposal for a solution.

-- 
You are receiving this mail because:
You are on the CC list for the bug.