sys-devel/gcc: backport security-fix for #620492

3 files changed, 255 insertions, 4 deletions

diff --git a/sys-devel/gcc/Manifest b/sys-devel/gcc/Manifest
index 1219e4e6..15aa2079 100644
--- a/sys-devel/gcc/Manifest
+++ b/sys-devel/gcc/Manifest
@@ -22,6 +22,7 @@ AUX gcc-4.9.3-secure-plt.patch 1478 SHA256 b9435e19c3193e872bfdce8f635755655cf6e
 AUX gcc-4.9.3-tree-vect-data-refs-correctness.patch 315 SHA256 904ae5ce2ecd5a2f7786c54d148a7562d0bb6f51fe60761038c2f57b8cf70356 SHA512 88d93c061ef72035522270ab60c8c2ec04e2fa2d69763f45b9eab0c37b19c23920484358d7556ad885775071ac04cf94684a2cd8ed93418d5f0c54ac3a045c9d WHIRLPOOL 2b9c281401abc111d53467c51b6238c6f4c430a73d8833f161766f973138ffe3b4fa1ffe5cc5813b5e2f8a81dee2cdcaaff2b9a8f8e13089f993f3ab3d69ccbd
 AUX gcc-5.4.0-pr68470.patch 2012 SHA256 f8949e1d35bf7bba80aec50bdcd5d6b008f731679b06f3d89e6d8a4eb98e492e SHA512 dea9ab12a37b88308424af2882b4755366745c204cd74e6892374d4aeb0981487f9fa1d44ab4d4e6184c83547c3ea30ed731719fa074bea62bdf8bfcf1dfbca0 WHIRLPOOL 2f66cd0d2dcaf237fd730eefe6f477970db14c237a8309925f799984a010f5470f6fc0f6a735316c7eab4de9dc958d773a4ffa14eea7093158690e9ff8f1847e
 AUX gcc-5.4.0-pr70473.patch 1665 SHA256 d674821a34356e78c4aa8405fc27f30effd5a7ab4f5929892e23a4c53023e137 SHA512 6fc8f70a1e34ae475d15fb20e198b63f00a11eff3bd09f1518b76d9622d32c9500beb49065bb1a32dc40119146f009bbda21fd0e74bc200771384b547f282680 WHIRLPOOL d22f1daec32b91bd29d6b87481681c86f405b4f5567468339b9f25e0e5ad6818d171db1692be588a0174767f9fcdf21a28d895932a8ef7a2ecc910a1984075db
+AUX gcc-5.4.0-pr71696-CVE-2016-6131.patch 7759 SHA256 2cc5c6d5da82ca102e79f561cc6c5df2a8522440f0f1c34365e45e8ed275c677 SHA512 234918537a87c2a607cb0cd0f3127f84916c96d11c8bf80ddc270ad7a6c038c15e985d52e5ed8a054bdc51f46e1ba4e0fdf8de2f4ce4bef5c78f68a3c29578fc WHIRLPOOL ffefd49f033776b725838586ddb60ac5a2ccfe3d78937c2ad46f0473789c4e8dd4f61ad42f421a0cd6c170959969363375f484ef21777144e448b2a7bb3b88bf
 AUX gcc-7.1.0-pr80706.patch 3306 SHA256 5fe4ae00ef68686a37e4bacd4424c9950a91e12a19d2b6a857524b558d49acf2 SHA512 4c5a72c221d21a6ad03586d4f570caffb16be041d7a232c6da2622fd8603341c4a4e97cc48b61509fb9be04ba59d06c339a2718cf72803cff67bc31813c5161c WHIRLPOOL f3876e3d682af9ca3584a6c877c5b452e529a93adbbc69fde5a9dc0d8b973a5c4f13c5322bd70e0cd1971970a09c9891313ea51648eda8457ca8e20326dc1e8e
 AUX gcc-configure-LANG.patch 2052 SHA256 63de6d2dcfe14f21d147abeb1390405b9220c03f8e968f482d4b4c1cf279c88b SHA512 a694c7ac2f45cc657097ff5b0cf1356ac88a9c06035c9ba15167e9d444844d0d8a478eb1b9b62195dd063774f79697b9148b9cdb6c261640b472c291061b2129 WHIRLPOOL 3cc1ec912fb192ff1058de5b93e49a994ba30d1501a932290dd5b3df1cd783875621cda56edeb41894cd5fa10c04917e693a40a60be8d742ddd7992bf5d8afeb
 AUX gcc-configure-texinfo.patch 337 SHA256 74b73a7ecec2d88889876b4db480cd173632f49d5396bb8e5b3c93673f9b5b98 SHA512 a15fba8bf2ff02bdeca54d6f186bfa08c1079c6a8ba0a3beef154483ce5c1b8c497e7ffeec32371968f0037e0ff8384609eb0c367d0155a4e5a7eef8aad084d5 WHIRLPOOL 39d008aad06f7621e4e5db15f5e85a59e583b43f8d247029bd4944466bb60a9795bda157d185c45c329294078e282703a243aad5c468d90c77665dd6336870d4
@@ -54,8 +55,6 @@ DIST gcc-5.4.0-patches-1.4.tar.bz2 28425 SHA256 039b88a939c3b90777fb94c58980cbcf
 DIST gcc-5.4.0-piepatches-v0.6.5.tar.bz2 14551 SHA256 495eb9110244dac17408cd0eb6977a593577eeb0437e72b60339b8ec394f2fb0 SHA512 4890f0713d261982ab81a20f93c5f65193aa1dfa171e3f9e5867f0b80ec7c1e76c5a997b1a4e6f47f8ce36af54ac91125c5bff8bf6d971b7d77c65a57a40a3c0 WHIRLPOOL 13b74b1ca75cc94f9624fe1b52221a953962c918c2cb932302a3078b6deba4f3e501647ad8a2915edef6301e64c820ed612a6fbb9e1178cf1711fe0045686969
 DIST gcc-5.4.0-uclibc-patches-1.0.tar.bz2 3731 SHA256 a3145faa6c81c0753ba754b735834c38987c356dadaa7c4a625c738e374604b5 SHA512 009f34197e79c5e8c6497a0db01ac45cc657e92e56a663b4f3281661d108b2a129cd977fab5f0064f225d6812ae91e82bab22a2b10ae02c486881eeed85ec7a3 WHIRLPOOL a3598ce0aad7e9110db156005190739abc5b4ceea3c327cb9c747c4cf1b99589c1a9fac170aea346eae030b09ee563f9f990e031ad7dfa1aa19b895898bf2608
 DIST gcc-5.4.0.tar.bz2 95661481 SHA256 608df76dec2d34de6558249d8af4cbee21eceddbcb580d666f7a5a583ca3303a SHA512 2941cc950c8f2409a314df497631f9b0266211aa74746c1839c46e04f1c7c299afe2528d1ef16ea39def408a644ba48f97519ec7a7dd37d260c3e9423514265b WHIRLPOOL ec81c8143e48bc8d9d0bbdc0fa3ca553c805193f53ac46c86127b54565894780dd97281485e396a130567464c753f043458c8e450018c957813f50ff90a40708
-DIST gcc-6.3.0-patches-1.0.tar.bz2 7596 SHA256 6c880468ffa4ad2b324fd18c762dbdf10646089c8ab865c228e166f99a0e049c SHA512 8fc96086bd3da3726687ee9d180d3b5d0a7d5814141d44eac8eb01566a783ec780c8fb8f55f75d6e9c9006b2e407e20cdb5835d541b0b66a47dd60642861734c WHIRLPOOL b1bce94d6134db6c9aff4298c6c7af003e39d0411aa40cd027d2c7d6a256971c81fb557e85b25f1107e9a474cb7d772c3bc62a7a4ab7ff7fca5eeae5b2ca0c94
-DIST gcc-6.3.0.tar.bz2 99903185 SHA256 f06ae7f3f790fbf0f018f6d40e844451e6bc3b7bc96e128e63b09825c1f8b29f SHA512 234dd9b1bdc9a9c6e352216a7ef4ccadc6c07f156006a59759c5e0e6a69f0abcdc14630eff11e3826dd6ba5933a8faa43043f3d1d62df6bd5ab1e82862f9bf78 WHIRLPOOL e79a2d6ad199396b6efd835c1129d049a367174ea33dd3b6247d72461f117c2dd81e5a66f3dd6427ce500e768d3a4453efd0debcb56966d00c7df79d05d54b7d
 DIST gcc-6.4.0-patches-1.0.tar.bz2 7577 SHA256 9c9b68c28e67be281c9bcec5d944b2a3439bab953dce08fd35a65b10f9dae3cd SHA512 e649e334eec4deb7c261d808ed460413d78a2a4a672823d214c1e173a13bc314ce898fbf3674a7c7fe3151a089384ee0a7dee479bc8d005a06b65b39216bdf75 WHIRLPOOL d7d9a80038fb939c26605d91eda9bc23070179bdf6ce597255c44f9d83f2603aae91d9890d2a445bce8c682708743021485f1415cea0b9b8f02dd9d982e36d3b
 DIST gcc-6.4.0.tar.xz 76156220 SHA256 850bf21eafdfe5cd5f6827148184c08c4a0852a37ccf36ce69855334d2c914d4 SHA512 02c60e54527c7adf584798d5251f8a0b80c93d5deafce82501b2c28e6692e0bd783927bbfc4bc527a863c0cccc025150a34740a9e29badb02d4b48e56a8aba90 WHIRLPOOL 136b282c6957877d2f463d83740fa65a4e7a346ac94e4baabea25cec41ae307f34409b1e518a22927821d564b8634a48978dc8e1d0b988999e924adcbf3f5cc9
 DIST gcc-7.1.0-patches-1.1.tar.bz2 6746 SHA256 39d4a0c659cc361bd3c71fdc9b793bccfa2bce06ede65ac49b805d1e236fcc8e SHA512 1bf95a505dc6c37bf6924bb69fd0670c8f3355b6690c94edf4a4248649accbd426575b40cb7a473dfb0ae09a924b05619e5c633384bae0293edb670cfd0d3a30 WHIRLPOOL 9682649fff62b56683637d25a58d11928342d99e52b2269f42369fd1d691208a7645802cb0d609ac30e20593ecdceb8cb1ab9b216963afe14db1b17ed43d5eb7
@@ -63,8 +62,7 @@ DIST gcc-7.1.0.tar.bz2 84303533 SHA256 8a8136c235f64c6fef69cac0d73a46a1a09bb2507
 DIST gcc-7.2.0.tar.xz 62312628 SHA256 1cf7adf8ff4b5aa49041c8734bbcf1ad18cc4c94d0029aae0f4e48841088479a SHA512 f853cd6530b4055d8d8289da74687cb4c6d5f363598d386332d31852b581bac76c3adb7d61889edec3b779f63d8646f0122840f12965ce4a4389ba535dbbb6e1 WHIRLPOOL 9503fb08731d94b5d79b182579f41992e9db16dba8a034cbfa8a2703a975185859e79c1e3f6094d14d08c7f5d7135c2ca5ffd8d6f7ae7820c20d4076fe5e9f65
 EBUILD gcc-4.9.4-r100.ebuild 2313 SHA256 08ca3c854dc7fdf863a659f0c745bbe92a094a60b71beb12aca2bcef8a555c1c SHA512 780400349b18484bfa253091bc0d9f17319fb892d202b226f72f114ee48d843665bf1ec00e08ef9ea0bf77ea72e13c4f1e2b732d63a252528e6d4ffcf92e151f WHIRLPOOL 9333b35db26f056416975313e4510d775b23844c2c4c8a3847b9ccb8b010fa983adf940ba2a1577d4de45c522de26d56d638115a814bde44084d3b3bcb06ce07
 EBUILD gcc-4.9.4-r99.ebuild 2261 SHA256 770df64ec98bcc6071a482abfa68b3b38a0187b6e13d58ad8b26ef8495e7ec07 SHA512 ba472cc558a94e3ed8632681c7678287fadc0303f1ff88b575e5b41e9087f9efff7332621523618eabc2fac85f71dad6a16194b9b8d55d023f77af2fe2d235b8 WHIRLPOOL d0bbcf867f789e469171f30d8188264ee66426fba8662f26b47bb0befe91fea2d9d2ac50e640816e5c746648b478414ac62ff5db2d97452becc4d1863159a725
-EBUILD gcc-5.4.0-r3.ebuild 1934 SHA256 36e98bd1c5ee2d19a7697b355b8a19c7d01492684859b15a64ac8af6885e0db9 SHA512 d990dd134e345d4653ee96745436cc686a7fa2cfba3f5c0d544114636bd1796b2000e274cd7cadc67cc738282afc448795565529bc3805065b428fe849ec74ec WHIRLPOOL 39c5aa57966317e686d471831ef73dd506da15507dddf0231cb310a590fef2aae69580eddec1d402ba728fcf3ac33bc32343bcb221f0b563372e24fb6fcdaa33
-EBUILD gcc-6.3.0.ebuild 902 SHA256 f75f2d455bd332ab08dcb12ef5101319b9117ea48d773e782d7ec9e9bd017738 SHA512 2cb339bd2003d2e6c0e649377c693a5c6874583ac27d1b60ffa3bc9723f83c26554dd385154133e8384a92e85c0c134bbb787c7ba34e1ca174f05e23758d1bb2 WHIRLPOOL 88a7ef0e56136cb610f16aa92be0967f40d59d7ee1877bddc213035fd8007745beb2743b5016acfa6bf6a3f334e002e311c0e457aea2b68d4f7a9e311f6f1d4b
+EBUILD gcc-5.4.0-r3.ebuild 1996 SHA256 567af678dcc952f80eb5ceb5084ef4692471a165a0e528ae04f7c549f8155827 SHA512 14e55f3a815b62772623bac1e44ae96c5a4d6ebbad15453d1effd0d4d6cf4f1c3a59077f888fd47da274972539ac866d6f83fa5325d9b044403f774ada0ec9f2 WHIRLPOOL 4eaffc879bf94eed6bc0f977791dc839b85efd3b54f8e8d330763fe1743af239c74381aacc9d8f34e382786395371794c23534e27b8c534c0a21f2973700fa43
 EBUILD gcc-6.4.0.ebuild 902 SHA256 e54104dd9fd73c8017661a03c3614e71c40bf9be73ddbe87fe11e3c7d0efb004 SHA512 1fb4edafa2d62cd6e34fb42e5b07adaeb036fae0c4819416f8f24d612c49c51fac1ad1c356d8b82822ac772919016a7125294d8609fd5209fb3a63155af56541 WHIRLPOOL 9073081c7e4453d83e8d86e664712f96422b0bc1383a416ce22b3a475a9df496e10788e93fa0462e52ff31f07b911015f5f29587cfe0ec094757a727012e83a5
 EBUILD gcc-7.1.0-r1.ebuild 670 SHA256 09e9bafeeaad9b0b897d2b4da1b8c3ee56daf3401eea3f7a63ee62fd6fe696f5 SHA512 90875ac0b5bffe3488c681d375f671d54b03806613d3b4618f650f2fd44727cf687d923afe10ba1f9b0ceba2575814867ed1b28b2ed7601cdb7d97ee53a62a80 WHIRLPOOL 621007ffa8a4ce055ce5125fd51b7934f584e64577afcea24f3e2aa7e77e4d87373de7b4a9f40717afd69686838784583a2228bebe0c72feaba631baae54943b
 EBUILD gcc-7.2.0.ebuild 627 SHA256 2b2a8ec991537047e5cd9b5f5194e6c26311b2aa937ba94b0f72364e8fcaeb49 SHA512 31c11b6d6394e7c7216f0ba1fd7581a5a18672294773c90b3850042be483558829ea942eb4692486f7b050b67c1884ca83e1c10e88023e8ff4e1fe076d13f2d3 WHIRLPOOL b500acb946855d3adc5ad7297a520bb14fdd4120f0997065c2aaa8008b889fdfeee08fd0b395264c14260cf13e6a7aaf973378d38174050068b69cd6d24c9fa6
diff --git a/sys-devel/gcc/files/gcc-5.4.0-pr71696-CVE-2016-6131.patch b/sys-devel/gcc/files/gcc-5.4.0-pr71696-CVE-2016-6131.patch
new file mode 100644
index 00000000..b16edbbe
--- /dev/null
+++ b/sys-devel/gcc/files/gcc-5.4.0-pr71696-CVE-2016-6131.patch
@@ -0,0 +1,252 @@
+From b3f6b32165d3f437bd0ac6269c3c499b68ecf036 Mon Sep 17 00:00:00 2001
+From: law <law@138bc75d-0d04-0410-961f-82ee72b054a4>
+Date: Thu, 4 Aug 2016 16:53:18 +0000
+Subject: [PATCH] Fix for PR71696 in Libiberty Demangler
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[BZ #71696] -- https://gcc.gnu.org/bugzilla/show_bug.cgi?id=71696
+
+2016-08-04  Marcel Böhme  <boehme.marcel@gmail.com>
+
+	PR c++/71696
+	* cplus-dem.c: Prevent infinite recursion when there is a cycle
+	in the referencing of remembered mangled types.
+	(work_stuff): New stack to keep track of the remembered mangled
+	types that are currently being processed.
+	(push_processed_type): New method to push currently processed
+	remembered type onto the stack.
+	(pop_processed_type): New method to pop currently processed
+	remembered type from the stack.
+	(work_stuff_copy_to_from): Copy values of new variables.
+	(delete_non_B_K_work_stuff): Free stack memory.
+	(demangle_args): Push/Pop currently processed remembered type.
+	(do_type): Do not demangle a cyclic reference and push/pop
+	referenced remembered type.
+
+cherry-picked from commit of
+git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/trunk@239143 138bc75d-0d04-0410-961f-82ee72b054a4
+
+Upstream-Status: Backport [master]
+CVE: CVE-2016-6131
+Signed-off-by: Yuanjie Huang <yuanjie.huang@windriver.com>
+---
+ libiberty/ChangeLog                   | 17 ++++++++
+ libiberty/cplus-dem.c                 | 78 ++++++++++++++++++++++++++++++++---
+ libiberty/testsuite/demangle-expected | 18 ++++++++
+ 3 files changed, 108 insertions(+), 5 deletions(-)
+
+diff --git a/libiberty/ChangeLog b/libiberty/ChangeLog
+index 9859ad3..7939480 100644
+--- a/libiberty/ChangeLog
++++ b/libiberty/ChangeLog
+@@ -1,3 +1,20 @@
++2016-08-04  Marcel Böhme  <boehme.marcel@gmail.com>
++
++	PR c++/71696
++	* cplus-dem.c: Prevent infinite recursion when there is a cycle
++	in the referencing of remembered mangled types.
++	(work_stuff): New stack to keep track of the remembered mangled
++	types that are currently being processed.
++	(push_processed_type): New method to push currently processed
++	remembered type onto the stack.
++	(pop_processed_type): New method to pop currently processed
++	remembered type from the stack.
++	(work_stuff_copy_to_from): Copy values of new variables.
++	(delete_non_B_K_work_stuff): Free stack memory.
++	(demangle_args): Push/Pop currently processed remembered type.
++	(do_type): Do not demangle a cyclic reference and push/pop
++	referenced remembered type.
++
+ 2016-06-03  Release Manager
+ 
+ 	* GCC 5.4.0 released.
+diff --git a/libiberty/cplus-dem.c b/libiberty/cplus-dem.c
+index 7514e57..f21e630 100644
+--- a/libiberty/cplus-dem.c
++++ b/libiberty/cplus-dem.c
+@@ -144,6 +144,9 @@ struct work_stuff
+   string* previous_argument; /* The last function argument demangled.  */
+   int nrepeats;         /* The number of times to repeat the previous
+ 			   argument.  */
++  int *proctypevec;     /* Indices of currently processed remembered typevecs.  */
++  int proctypevec_size;
++  int nproctypes;
+ };
+ 
+ #define PRINT_ANSI_QUALIFIERS (work -> options & DMGL_ANSI)
+@@ -435,6 +438,10 @@ iterate_demangle_function (struct work_stuff *,
+ 
+ static void remember_type (struct work_stuff *, const char *, int);
+ 
++static void push_processed_type (struct work_stuff *, int);
++
++static void pop_processed_type (struct work_stuff *);
++
+ static void remember_Btype (struct work_stuff *, const char *, int, int);
+ 
+ static int register_Btype (struct work_stuff *);
+@@ -1301,6 +1308,10 @@ work_stuff_copy_to_from (struct work_stuff *to, struct work_stuff *from)
+       memcpy (to->btypevec[i], from->btypevec[i], len);
+     }
+ 
++  if (from->proctypevec)
++    to->proctypevec =
++      XDUPVEC (int, from->proctypevec, from->proctypevec_size);
++
+   if (from->ntmpl_args)
+     to->tmpl_argvec = XNEWVEC (char *, from->ntmpl_args);
+ 
+@@ -1329,11 +1340,17 @@ delete_non_B_K_work_stuff (struct work_stuff *work)
+   /* Discard the remembered types, if any.  */
+ 
+   forget_types (work);
+-  if (work -> typevec != NULL)
++  if (work->typevec != NULL)
+     {
+-      free ((char *) work -> typevec);
+-      work -> typevec = NULL;
+-      work -> typevec_size = 0;
++      free ((char *) work->typevec);
++      work->typevec = NULL;
++      work->typevec_size = 0;
++    }
++  if (work->proctypevec != NULL)
++    {
++      free (work->proctypevec);
++      work->proctypevec = NULL;
++      work->proctypevec_size = 0;
+     }
+   if (work->tmpl_argvec)
+     {
+@@ -3552,6 +3569,8 @@ static int
+ do_type (struct work_stuff *work, const char **mangled, string *result)
+ {
+   int n;
++  int i;
++  int is_proctypevec;
+   int done;
+   int success;
+   string decl;
+@@ -3564,6 +3583,7 @@ do_type (struct work_stuff *work, const char **mangled, string *result)
+ 
+   done = 0;
+   success = 1;
++  is_proctypevec = 0;
+   while (success && !done)
+     {
+       int member;
+@@ -3616,8 +3636,15 @@ do_type (struct work_stuff *work, const char **mangled, string *result)
+ 	      success = 0;
+ 	    }
+ 	  else
++	    for (i = 0; i < work->nproctypes; i++)
++	      if (work -> proctypevec [i] == n)
++	        success = 0;
++
++	  if (success)
+ 	    {
+-	      remembered_type = work -> typevec[n];
++	      is_proctypevec = 1;
++	      push_processed_type (work, n);
++	      remembered_type = work->typevec[n];
+ 	      mangled = &remembered_type;
+ 	    }
+ 	  break;
+@@ -3840,6 +3867,9 @@ do_type (struct work_stuff *work, const char **mangled, string *result)
+     string_delete (result);
+   string_delete (&decl);
+ 
++  if (is_proctypevec)
++    pop_processed_type (work);
++
+   if (success)
+     /* Assume an integral type, if we're not sure.  */
+     return (int) ((tk == tk_none) ? tk_integral : tk);
+@@ -4252,6 +4282,41 @@ do_arg (struct work_stuff *work, const char **mangled, string *result)
+ }
+ 
+ static void
++push_processed_type (struct work_stuff *work, int typevec_index)
++{
++  if (work->nproctypes >= work->proctypevec_size)
++    {
++      if (!work->proctypevec_size)
++	{
++	  work->proctypevec_size = 4;
++	  work->proctypevec = XNEWVEC (int, work->proctypevec_size);
++	}
++      else
++	{
++	  if (work->proctypevec_size < 16)
++	    /* Double when small.  */
++	    work->proctypevec_size *= 2;
++	  else
++	    {
++	      /* Grow slower when large.  */
++	      if (work->proctypevec_size > (INT_MAX / 3) * 2)
++                xmalloc_failed (INT_MAX);
++              work->proctypevec_size = (work->proctypevec_size * 3 / 2);
++	    }
++          work->proctypevec
++            = XRESIZEVEC (int, work->proctypevec, work->proctypevec_size);
++	}
++    }
++    work->proctypevec [work->nproctypes++] = typevec_index;
++}
++
++static void
++pop_processed_type (struct work_stuff *work)
++{
++  work->nproctypes--;
++}
++
++static void
+ remember_type (struct work_stuff *work, const char *start, int len)
+ {
+   char *tem;
+@@ -4515,10 +4580,13 @@ demangle_args (struct work_stuff *work, const char **mangled,
+ 		{
+ 		  string_append (declp, ", ");
+ 		}
++	      push_processed_type (work, t);
+ 	      if (!do_arg (work, &tem, &arg))
+ 		{
++		  pop_processed_type (work);
+ 		  return (0);
+ 		}
++	      pop_processed_type (work);
+ 	      if (PRINT_ARG_TYPES)
+ 		{
+ 		  string_appends (declp, &arg);
+diff --git a/libiberty/testsuite/demangle-expected b/libiberty/testsuite/demangle-expected
+index 1d8b771..d690b23 100644
+--- a/libiberty/testsuite/demangle-expected
++++ b/libiberty/testsuite/demangle-expected
+@@ -4429,3 +4429,21 @@ __vt_90000000000cafebabe
+ 
+ _Z80800000000000000000000
+ _Z80800000000000000000000
++#
++# Tests write access violation PR70926
++
++0__Ot2m02R5T0000500000
++0__Ot2m02R5T0000500000
++#
++
++0__GT50000000000_
++0__GT50000000000_
++#
++
++__t2m05B500000000000000000_
++__t2m05B500000000000000000_
++#
++# Tests stack overflow PR71696
++
++__10%0__S4_0T0T0
++%0<>::%0(%0<>)
+-- 
+2.9.3
+
+
diff --git a/sys-devel/gcc/gcc-5.4.0-r3.ebuild b/sys-devel/gcc/gcc-5.4.0-r3.ebuild
index 5696f213..f147ac93 100644
--- a/sys-devel/gcc/gcc-5.4.0-r3.ebuild
+++ b/sys-devel/gcc/gcc-5.4.0-r3.ebuild
@@ -48,6 +48,7 @@ src_prepare() {
 	epatch "${FILESDIR}"/${PN}-4.9.3-tree-vect-data-refs-correctness.patch
 	epatch "${FILESDIR}"/${PN}-5.4.0-pr68470.patch
 	epatch "${FILESDIR}"/${PN}-5.4.0-pr70473.patch
+	epatch "${FILESDIR}"/${PN}-5.4.0-pr71696-CVE-2016-6131.patch
 
 	if use elibc_musl || [[ ${CATEGORY} = cross-*-musl ]]; then
 		epatch "${FILESDIR}"/4.9.4/gthread.patch