From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!.POSTED!not-for-mail From: Eli Zaretskii Newsgroups: gmane.emacs.bugs Subject: bug#24751: 26.0.50; Regex stack overflow not detected properly (gets "Variable binding depth exceeds max-specpdl-size") Date: Sun, 13 Nov 2016 18:12:47 +0200 Message-ID: <83a8d3cq9s.fsf@gnu.org> References: <87twc6tl0i.fsf@users.sourceforge.net> <83h97nlknj.fsf@gnu.org> <87mvhdoh4q.fsf@users.sourceforge.net> <83zilcipcr.fsf@gnu.org> <87a8d4lyzo.fsf@users.sourceforge.net> Reply-To: Eli Zaretskii NNTP-Posting-Host: blaine.gmane.org X-Trace: blaine.gmane.org 1479053616 24815 195.159.176.226 (13 Nov 2016 16:13:36 GMT) X-Complaints-To: usenet@blaine.gmane.org NNTP-Posting-Date: Sun, 13 Nov 2016 16:13:36 +0000 (UTC) Cc: 24751@debbugs.gnu.org To: npostavs@users.sourceforge.net Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Sun Nov 13 17:13:29 2016 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by blaine.gmane.org with esmtp (Exim 4.84_2) (envelope-from ) id 1c5xP3-0003Aj-1J for geb-bug-gnu-emacs@m.gmane.org; Sun, 13 Nov 2016 17:13:09 +0100 Original-Received: from localhost ([::1]:34233 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1c5xP6-0007mQ-78 for geb-bug-gnu-emacs@m.gmane.org; Sun, 13 Nov 2016 11:13:12 -0500 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:38982) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1c5xP0-0007mK-7m for bug-gnu-emacs@gnu.org; Sun, 13 Nov 2016 11:13:07 -0500 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1c5xOv-0002gs-Uq for bug-gnu-emacs@gnu.org; Sun, 13 Nov 2016 11:13:06 -0500 Original-Received: from debbugs.gnu.org ([208.118.235.43]:40610) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1c5xOv-0002gm-Qw for bug-gnu-emacs@gnu.org; Sun, 13 Nov 2016 11:13:01 -0500 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1c5xOv-0007tZ-Jm for bug-gnu-emacs@gnu.org; Sun, 13 Nov 2016 11:13:01 -0500 X-Loop: help-debbugs@gnu.org Resent-From: Eli Zaretskii Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Sun, 13 Nov 2016 16:13:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 24751 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: Original-Received: via spool by 24751-submit@debbugs.gnu.org id=B24751.147905356830327 (code B ref 24751); Sun, 13 Nov 2016 16:13:01 +0000 Original-Received: (at 24751) by debbugs.gnu.org; 13 Nov 2016 16:12:48 +0000 Original-Received: from localhost ([127.0.0.1]:56009 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1c5xOi-0007t4-FS for submit@debbugs.gnu.org; Sun, 13 Nov 2016 11:12:48 -0500 Original-Received: from eggs.gnu.org ([208.118.235.92]:47873) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1c5xOg-0007so-Ec for 24751@debbugs.gnu.org; Sun, 13 Nov 2016 11:12:46 -0500 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1c5xOX-0002bj-W7 for 24751@debbugs.gnu.org; Sun, 13 Nov 2016 11:12:41 -0500 Original-Received: from fencepost.gnu.org ([2001:4830:134:3::e]:49848) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1c5xOX-0002bf-T2; Sun, 13 Nov 2016 11:12:37 -0500 Original-Received: from 84.94.185.246.cable.012.net.il ([84.94.185.246]:4902 helo=home-c4e4a596f7) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_128_CBC_SHA1:128) (Exim 4.82) (envelope-from ) id 1c5xOX-00072y-8F; Sun, 13 Nov 2016 11:12:37 -0500 In-reply-to: <87a8d4lyzo.fsf@users.sourceforge.net> (npostavs@users.sourceforge.net) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 208.118.235.43 X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Original-Sender: "bug-gnu-emacs" Xref: news.gmane.org gmane.emacs.bugs:125662 Archived-At: > From: npostavs@users.sourceforge.net > Cc: 24751@debbugs.gnu.org > Date: Sun, 13 Nov 2016 00:39:39 -0500 > > > I think the patch can be simplified, where we now multiply by the size > > of fail_stack_elt_t and then divide by it: simply remove both the > > multiplication and the division. That will make the code easier to > > read, and will make the units of each variable clear, something that I > > think is at the heart of this issue. > > Ah, right. Thanks, LGTM. > >> but effectively increases the size of the failure stack (so the > >> sample file size has to be increased 8-fold to get a regex stack > >> overflow). > > > > Which IMO is exactly TRT, since re_max_failures was computed given the > > runtime stack size of 8MB, so having it bail out after merely 800KB > > doesn't sound right to me, don't you agree? > > Yes, I suppose we should also try to make use of the stack, rather than > calling malloc, right? Something like this: > > diff --git i/src/regex.c w/src/regex.c > index d23ba01..dcabde5 100644 > --- i/src/regex.c > +++ w/src/regex.c > @@ -447,7 +447,11 @@ init_syntax_once (void) > #else /* not REGEX_MALLOC */ > > # ifdef emacs > -# define REGEX_USE_SAFE_ALLOCA USE_SAFE_ALLOCA > +# define REGEX_USE_SAFE_ALLOCA \ > + ptrdiff_t sa_avail = re_max_failures \ > + * TYPICAL_FAILURE_SIZE * sizeof (fail_stack_elt_t); \ > + ptrdiff_t sa_count = SPECPDL_INDEX (); bool sa_must_free = false > + Yes. And please also add a comment there saying that this replaces USE_SAFE_ALLOCA. > -size_t re_max_failures = 40000; > +size_t re_max_failures = 20; > # else > size_t re_max_failures = 4000; > # endif > > > Actually I find Emacs still compiles if I removed that line completely, > there's just a compile warning saying > > regex.o: In function `re_match_2_internal': > /home/npostavs/src/emacs/emacs-master/lib-src/../src/regex.c:5529: warning: the 're_max_failures' variable is obsolete and will go away. > > I guess there's some kind of definition of it in libc? Most probably. You should be able to see that using "nm -A". If that's indeed so, I think we should rename that variable to something like emacs_re_max_failures, to avoid stomping on the libc variable..