From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Alexandre Oliva Newsgroups: gmane.emacs.devel,gmane.emacs.pretest.bugs Subject: memory corruption in regex.c Date: Sat, 22 Mar 2008 08:25:35 -0300 Message-ID: <200803221125.m2MBPZ7q021670@livre.oliva.athome.lsd.ic.unicamp.br> NNTP-Posting-Host: lo.gmane.org X-Trace: ger.gmane.org 1206205431 18068 80.91.229.12 (22 Mar 2008 17:03:51 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Sat, 22 Mar 2008 17:03:51 +0000 (UTC) To: emacs-pretest-bug@gnu.org Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Sat Mar 22 18:04:20 2008 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([199.232.76.165]) by lo.gmane.org with esmtp (Exim 4.50) id 1Jd78j-0004YC-Dh for ged-emacs-devel@m.gmane.org; Sat, 22 Mar 2008 18:04:18 +0100 Original-Received: from localhost ([127.0.0.1] helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Jd788-0004eK-SX for ged-emacs-devel@m.gmane.org; Sat, 22 Mar 2008 13:03:40 -0400 Original-Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1Jd1rB-00062s-Fz for emacs-devel@gnu.org; Sat, 22 Mar 2008 07:25:49 -0400 Original-Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1Jd1r9-000627-Om for emacs-devel@gnu.org; Sat, 22 Mar 2008 07:25:49 -0400 Original-Received: from [199.232.76.173] (helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Jd1r9-000622-Kr for emacs-devel@gnu.org; Sat, 22 Mar 2008 07:25:47 -0400 Original-Received: from fencepost.gnu.org ([140.186.70.10]) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1Jd1r9-0001BQ-GQ for emacs-devel@gnu.org; Sat, 22 Mar 2008 07:25:47 -0400 Original-Received: from mail.gnu.org ([199.232.76.166] helo=mx10.gnu.org) by fencepost.gnu.org with esmtp (Exim 4.67) (envelope-from ) id 1Jd1r8-00053g-Ss for emacs-pretest-bug@gnu.org; Sat, 22 Mar 2008 07:25:46 -0400 Original-Received: from Debian-exim by monty-python.gnu.org with spam-scanned (Exim 4.60) (envelope-from ) id 1Jd1r3-00019y-Br for emacs-pretest-bug@gnu.org; Sat, 22 Mar 2008 07:25:44 -0400 Original-Received: from lsd-gw.ic.unicamp.br ([143.106.7.165] helo=marquesa.lsd.ic.unicamp.br) by monty-python.gnu.org with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1Jd1r2-00019G-Ln for emacs-pretest-bug@gnu.org; Sat, 22 Mar 2008 07:25:41 -0400 Original-Received: from freie.oliva.athome.lsd.ic.unicamp.br (gw-to-emilia.oliva.athome.lsd.ic.unicamp.br [172.31.160.17] (may be forged)) by marquesa.lsd.ic.unicamp.br (8.14.1/8.14.1) with ESMTP id m2MBPaPK010382 for ; Sat, 22 Mar 2008 08:25:37 -0300 Original-Received: from livre.oliva.athome.lsd.ic.unicamp.br (livre.oliva.athome.lsd.ic.unicamp.br [172.31.160.2]) by freie.oliva.athome.lsd.ic.unicamp.br (8.14.2/8.14.1) with ESMTP id m2MBPaEE029536 for ; Sat, 22 Mar 2008 08:25:36 -0300 Original-Received: from livre.oliva.athome.lsd.ic.unicamp.br (localhost.localdomain [127.0.0.1]) by livre.oliva.athome.lsd.ic.unicamp.br (8.14.2/8.13.8) with ESMTP id m2MBPZkw021716 for ; Sat, 22 Mar 2008 08:25:36 -0300 Original-Received: (from aoliva@localhost) by livre.oliva.athome.lsd.ic.unicamp.br (8.14.2/8.13.5/Submit) id m2MBPZ7q021670; Sat, 22 Mar 2008 08:25:35 -0300 X-detected-kernel: by monty-python.gnu.org: Linux 2.6 (newer, 3) X-detected-kernel: by monty-python.gnu.org: Linux 2.6, seldom 2.4 (older, 4) X-Mailman-Approved-At: Sat, 22 Mar 2008 13:02:18 -0400 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:93191 gmane.emacs.pretest.bugs:21653 Archived-At: https://bugzilla.redhat.com/show_bug.cgi?id=435767 emacs invokes undefined behavior in regex.c, computing the difference between unrelated pointers. In general, this wouldn't be too much of a problem, as long as the type used to represent the difference was wide enough to cover the entire possible range of pointer differences. Such a type is not even guaranteed to exist, and it can be tricky to get reasonable results on segmented architectures. So, the correct code needs to compute offsets between pointers in the old buffer, and apply the same offset into the new buffer. On most cases, the compiler will just optimize the code to the same we got before on i386, and to something very close, but using a 64-bit offset on x86-64. The problem I got, of semi-random "Regular expression too big" errors, seems to have been caused at least in part by heap randomization, such that regex buffers were *sometimes* (but somewhat rarely) moved to locations that were too far away for the offset to be held correctly in an int, and then Bad Things Happened. I'm concerned that in this case emacs core memory may be corrupted. After the patch, I haven't seen the errors any more. However, given how difficult it was to trigger the bug in the first place, I can't be sure it is gone for good. But the fix is sound anyway. This bug is present in emacs-22.1.50 and in current CVS. for src/ChangeLog from Alexandre Oliva * regex.c (MOVE_BUFFER_POINTER, EXTEND_BUFFER): Don't compute offsets between unrelated pointers. --- emacs-22.1.50.orig/src/regex.c 2007-09-10 15:46:20.000000000 -0300 +++ emacs-22.1.50/src/regex.c 2008-03-22 08:07:06.000000000 -0300 @@ -3,7 +3,7 @@ internationalization features.) Copyright (C) 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, - 2002, 2003, 2004, 2005, 2006, 2007 + 2002, 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc. This program is free software; you can redistribute it and/or modify @@ -1832,8 +1832,10 @@ being larger than MAX_BUF_SIZE, then flag memory exhausted. */ #if __BOUNDED_POINTERS__ # define SET_HIGH_BOUND(P) (__ptrhigh (P) = __ptrlow (P) + bufp->allocated) -# define MOVE_BUFFER_POINTER(P) \ - (__ptrlow (P) += incr, SET_HIGH_BOUND (P), __ptrvalue (P) += incr) +# define MOVE_BUFFER_POINTER(P) \ + (__ptrlow (P) = new_buffer + (__ptrlow (P) - old_buffer), \ + SET_HIGH_BOUND (P), \ + __ptrvalue (P) = new_buffer + (__ptrvalue (P) - old_buffer)) # define ELSE_EXTEND_BUFFER_HIGH_BOUND \ else \ { \ @@ -1847,12 +1849,12 @@ SET_HIGH_BOUND (pending_exact); \ } #else -# define MOVE_BUFFER_POINTER(P) (P) += incr +# define MOVE_BUFFER_POINTER(P) ((P) = new_buffer + ((P) - old_buffer)) # define ELSE_EXTEND_BUFFER_HIGH_BOUND #endif #define EXTEND_BUFFER() \ do { \ - re_char *old_buffer = bufp->buffer; \ + unsigned char *old_buffer = bufp->buffer; \ if (bufp->allocated == MAX_BUF_SIZE) \ return REG_ESIZE; \ bufp->allocated <<= 1; \ @@ -1864,7 +1866,7 @@ /* If the buffer moved, move all the pointers into it. */ \ if (old_buffer != bufp->buffer) \ { \ - int incr = bufp->buffer - old_buffer; \ + unsigned char *new_buffer = bufp->buffer; \ MOVE_BUFFER_POINTER (b); \ MOVE_BUFFER_POINTER (begalt); \ if (fixup_alt_jump) \ -- Alexandre Oliva http://www.lsd.ic.unicamp.br/~oliva/ FSF Latin America Board Member http://www.fsfla.org/ Red Hat Compiler Engineer aoliva@{redhat.com, gcc.gnu.org} Free Software Evangelist oliva@{lsd.ic.unicamp.br, gnu.org}