Created attachment 8564 [details]
crashing test case

While fuzzing GNU c++filt (GNU Binutils) 2.25.51.20150826 with American Fuzzy Lop (http://lcamtuf.coredump.cx/afl/), I found a simple 12-byte file that causes cxxfilt to crash w/ the following command line:

./cxxfilt @test00-min

Valgrind:
==35143== Invalid read of size 1
==35143==    at 0x80CDBF: d_unqualified_name (cp-demangle.c:1547)
==35143==    by 0x813F87: d_name (cp-demangle.c:1391)
==35143==    by 0x815BE7: d_encoding (cp-demangle.c:1257)
==35143==    by 0x8189F4: cplus_demangle_mangled_name (cp-demangle.c:1172)
==35143==    by 0x81AD60: d_demangle_callback (cp-demangle.c:5886)
==35143==    by 0x81AD60: d_demangle (cp-demangle.c:5937)
==35143==    by 0x81AD60: cplus_demangle_v3 (cp-demangle.c:6094)
==35143==    by 0x783A73: cplus_demangle (cplus-dem.c:864)
==35143==    by 0x408192: demangle_it (cxxfilt.c:62)
==35143==    by 0x407618: main (cxxfilt.c:227)
==35143==  Address 0xffffffff8ae0ae97 is not stack'd, malloc'd or (recently) free'd
==35143== 
==35143== 
==35143== Process terminating with default action of signal 11 (SIGSEGV)
==35143==  Access not within mapped region at address 0xFFFFFFFF8AE0AE97
==35143==    at 0x80CDBF: d_unqualified_name (cp-demangle.c:1547)
==35143==    by 0x813F87: d_name (cp-demangle.c:1391)
==35143==    by 0x815BE7: d_encoding (cp-demangle.c:1257)
==35143==    by 0x8189F4: cplus_demangle_mangled_name (cp-demangle.c:1172)
==35143==    by 0x81AD60: d_demangle_callback (cp-demangle.c:5886)
==35143==    by 0x81AD60: d_demangle (cp-demangle.c:5937)
==35143==    by 0x81AD60: cplus_demangle_v3 (cp-demangle.c:6094)
==35143==    by 0x783A73: cplus_demangle (cplus-dem.c:864)
==35143==    by 0x408192: demangle_it (cxxfilt.c:62)
==35143==    by 0x407618: main (cxxfilt.c:227)
==35143==  If you believe this happened as a result of a stack
==35143==  overflow in your program's main thread (unlikely but
==35143==  possible), you can try to increase the size of the
==35143==  main thread stack using the --main-stacksize= flag.
==35143==  The main thread stack size used in this run was 8388608.
Segmentation fault

GDB:
Program received signal SIGSEGV, Segmentation fault.
0x000000000080cdbf in d_unqualified_name () at ./cp-demangle.c:1547
1547	    ret = d_source_name (di);
(gdb) bt
#0  0x000000000080cdbf in d_unqualified_name () at ./cp-demangle.c:1547
#1  0x0000000000813f88 in d_name () at ./cp-demangle.c:1391
#2  0x0000000000815be8 in d_encoding () at ./cp-demangle.c:1257
#3  0x00000000008189f5 in cplus_demangle_mangled_name () at ./cp-demangle.c:1172
#4  0x000000000081ad61 in cplus_demangle_v3 () at ./cp-demangle.c:5886
#5  0x0000000000783a74 in cplus_demangle ()
#6  0x0000000000408193 in demangle_it () at cxxfilt.c:62
#7  0x0000000000407619 in main () at cxxfilt.c:227
(gdb) i r
rax            0x7fffffffde30	140737488346672
rbx            0x7fffffffe0c0	140737488347328
rcx            0xabe2e1	11264737
rdx            0x0	0
rsi            0xffffffff8a0fe4ec	-1978669844
rdi            0x0	0
rbp            0x7fffffffde30	0x7fffffffde30
rsp            0x7fffffffdcf0	0x7fffffffdcf0
r8             0xffffffd0	4294967248
r9             0x0	0
r10            0xffffffff8a0fe4ec	-1978669844
r11            0x18	24
r12            0x1	1
r13            0x7fffffffe080	140737488347264
r14            0x10b	267
r15            0xffffffffbc6	17592186043334
rip            0x80cdbf	0x80cdbf <d_unqualified_name+1439>
eflags         0x10202	[ IF RF ]
cs             0x33	51
ss             0x2b	43
ds             0x0	0
es             0x0	0
fs             0x0	0
gs             0x0	0