Be careful of mangled out of bounds read

1 files changed, 9 insertions, 5 deletions

diff --git a/src/common/demangle.cpp b/src/common/demangle.cpp
index 17abdb85e..f4246f666 100644
--- a/src/common/demangle.cpp
+++ b/src/common/demangle.cpp
@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 #include "common/demangle.h"
+#include "common/scope_exit.h"
 
 namespace llvm {
 char* itaniumDemangle(const char* mangled_name, char* buf, size_t* n, int* status);
@@ -13,10 +14,16 @@ std::string DemangleSymbol(const std::string& mangled) {
     auto is_itanium = [](const std::string& name) -> bool {
         // A valid Itanium encoding requires 1-4 leading underscores, followed by 'Z'.
         auto pos = name.find_first_not_of('_');
-        return pos > 0 && pos <= 4 && name[pos] == 'Z';
+        return pos > 0 && pos <= 4 && pos < name.size() && name[pos] == 'Z';
     };
 
+    if (mangled.empty()) {
+        return mangled;
+    }
+
     char* demangled = nullptr;
+    SCOPE_EXIT({ std::free(demangled); });
+
     if (is_itanium(mangled)) {
         demangled = llvm::itaniumDemangle(mangled.c_str(), nullptr, nullptr, nullptr);
     }
@@ -24,10 +31,7 @@ std::string DemangleSymbol(const std::string& mangled) {
     if (!demangled) {
         return mangled;
     }
-
-    std::string ret = demangled;
-    std::free(demangled);
-    return ret;
+    return demangled;
 }
 
 } // namespace Common