unofficial mirror of bug-gnu-emacs@gnu.org 
 help / color / mirror / code / Atom feed
From: "Gerd Möllmann" <gerd.moellmann@gmail.com>
To: Stefan Monnier <monnier@iro.umontreal.ca>, Eli Zaretskii <eliz@gnu.org>
Cc: 56108@debbugs.gnu.org
Subject: bug#56108: 29.0.50; ASAN use-after-free in re_match_2_internal
Date: Fri, 24 Jun 2022 11:35:18 +0200	[thread overview]
Message-ID: <d832b6b9-06fa-4276-bcf1-1acebf6524d9@Spark> (raw)
In-Reply-To: <f7bcb962-0afd-495f-b935-b5dc67c2aa48@Spark>


[-- Attachment #1.1: Type: text/plain, Size: 605 bytes --]

Please find patch attached.

Some notes about the patch:

• TRT, I think, would be to change the whole cacheing to use Lisp objects etc.  I couldn't persuade myself to do that.
• A less right thing, but better than the patch, would be to protect the cache entry in re_match_2_internal.  But that requires interface changes because re_match_2_internal currently doesn't know about cash entries.  I couldn't bring myself to do that either.

Another note:  Should some document mention that trailing whitespace are not allowed in the git repo?  I couldn't find that anywhere.






[-- Attachment #1.2: Type: text/html, Size: 1118 bytes --]

[-- Attachment #2: 0001-Prevent-reexp-cache-entry-GC-in-more-cases.patch --]
[-- Type: application/octet-stream, Size: 3836 bytes --]

From 69a31c9976316b3a0542503f8c34adb1782a954f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gerd=20M=C3=B6llmann?= <gerd@gnu.org>
Date: Fri, 24 Jun 2022 10:44:17 +0200
Subject: [PATCH] Prevent reexp cache entry GC in more cases

* src/search.c (string_match_1, fast_string_match_internal)
(fast_c_string_match_ignore_case): Use freeze_pattern.
---
 src/search.c | 49 ++++++++++++++++++++++++++-----------------------
 1 file changed, 26 insertions(+), 23 deletions(-)

diff --git a/src/search.c b/src/search.c
index 816a757c18..9d6bd074e1 100644
--- a/src/search.c
+++ b/src/search.c
@@ -370,7 +370,6 @@ string_match_1 (Lisp_Object regexp, Lisp_Object string, Lisp_Object start,
 		bool posix, bool modify_data)
 {
   ptrdiff_t val;
-  struct re_pattern_buffer *bufp;
   EMACS_INT pos;
   ptrdiff_t pos_byte, i;
   bool modify_match_data = NILP (Vinhibit_changing_match_data) && modify_data;
@@ -401,17 +400,22 @@ string_match_1 (Lisp_Object regexp, Lisp_Object string, Lisp_Object start,
   set_char_table_extras (BVAR (current_buffer, case_canon_table), 2,
 			 BVAR (current_buffer, case_eqv_table));
 
-  bufp = &compile_pattern (regexp,
-                           (modify_match_data ? &search_regs : NULL),
-                           (!NILP (BVAR (current_buffer, case_fold_search))
-                            ? BVAR (current_buffer, case_canon_table) : Qnil),
-                           posix,
-                           STRING_MULTIBYTE (string))->buf;
+  specpdl_ref count = SPECPDL_INDEX ();
+  struct regexp_cache *cache_entry
+    = compile_pattern (regexp,
+		       modify_match_data ? &search_regs : NULL,
+		       (!NILP (BVAR (current_buffer, case_fold_search))
+			? BVAR (current_buffer, case_canon_table)
+			: Qnil),
+		       posix,
+		       STRING_MULTIBYTE (string));
+  freeze_pattern (cache_entry);
   re_match_object = string;
-  val = re_search (bufp, SSDATA (string),
+  val = re_search (&cache_entry->buf, SSDATA (string),
 		   SBYTES (string), pos_byte,
 		   SBYTES (string) - pos_byte,
 		   (modify_match_data ? &search_regs : NULL));
+  unbind_to (count, Qnil);
 
   /* Set last_thing_searched only when match data is changed.  */
   if (modify_match_data)
@@ -480,15 +484,15 @@ DEFUN ("posix-string-match", Fposix_string_match, Sposix_string_match, 2, 4, 0,
 fast_string_match_internal (Lisp_Object regexp, Lisp_Object string,
 			    Lisp_Object table)
 {
-  ptrdiff_t val;
-  struct re_pattern_buffer *bufp;
-
-  bufp = &compile_pattern (regexp, 0, table,
-                           0, STRING_MULTIBYTE (string))->buf;
   re_match_object = string;
-  val = re_search (bufp, SSDATA (string),
-		   SBYTES (string), 0,
-		   SBYTES (string), 0);
+  specpdl_ref count = SPECPDL_INDEX ();
+  struct regexp_cache *cache_entry
+    = compile_pattern (regexp, 0, table, 0, STRING_MULTIBYTE (string));
+  freeze_pattern (cache_entry);
+  ptrdiff_t val = re_search (&cache_entry->buf, SSDATA (string),
+			     SBYTES (string), 0,
+			     SBYTES (string), 0);
+  unbind_to (count, Qnil);
   return val;
 }
 
@@ -501,15 +505,14 @@ fast_string_match_internal (Lisp_Object regexp, Lisp_Object string,
 fast_c_string_match_ignore_case (Lisp_Object regexp,
 				 const char *string, ptrdiff_t len)
 {
-  ptrdiff_t val;
-  struct re_pattern_buffer *bufp;
-
   regexp = string_make_unibyte (regexp);
-  bufp = &compile_pattern (regexp, 0,
-                           Vascii_canon_table, 0,
-                           0)->buf;
+  specpdl_ref count = SPECPDL_INDEX ();
+  struct regexp_cache *cache_entry
+    = compile_pattern (regexp, 0, Vascii_canon_table, 0, 0);
+  freeze_pattern (cache_entry);
   re_match_object = Qt;
-  val = re_search (bufp, string, len, 0, len, 0);
+  ptrdiff_t val = re_search (&cache_entry->buf, string, len, 0, len, 0);
+  unbind_to (count, Qnil);
   return val;
 }
 
-- 
2.36.1


  reply	other threads:[~2022-06-24  9:35 UTC|newest]

Thread overview: 22+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-06-20 14:07 bug#56108: 29.0.50; ASAN use-after-free in re_match_2_internal Gerd Möllmann
2022-06-20 19:09 ` Eli Zaretskii
2022-06-22  8:13   ` Gerd Möllmann
2022-06-22 13:38     ` Eli Zaretskii
2022-06-22 14:10       ` Gerd Möllmann
2022-06-22 14:24         ` Eli Zaretskii
2022-06-22 15:11           ` Gerd Möllmann
2022-06-22 16:19             ` Eli Zaretskii
2022-06-23  5:53               ` Gerd Möllmann
2022-06-23  6:57                 ` Eli Zaretskii
2022-06-23  7:17                   ` Eli Zaretskii
2022-06-23 21:29                     ` Stefan Monnier via Bug reports for GNU Emacs, the Swiss army knife of text editors
2022-06-24  5:55                       ` Eli Zaretskii
2022-06-24  6:01                         ` Gerd Möllmann
2022-06-24  9:35                           ` Gerd Möllmann [this message]
2022-06-24 15:40                             ` Eli Zaretskii
2022-06-25  9:18                               ` Eli Zaretskii
2022-06-27 13:26                             ` Eli Zaretskii
2022-06-27 13:29                               ` Gerd Möllmann
2022-06-23  8:24                   ` Gerd Möllmann
2022-06-23  8:37                     ` Eli Zaretskii
2022-06-23  8:49                       ` Gerd Möllmann

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: https://www.gnu.org/software/emacs/

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=d832b6b9-06fa-4276-bcf1-1acebf6524d9@Spark \
    --to=gerd.moellmann@gmail.com \
    --cc=56108@debbugs.gnu.org \
    --cc=eliz@gnu.org \
    --cc=monnier@iro.umontreal.ca \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/emacs.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).