Subject: bug#51710: closed (Re: bug#51710: [PATCH] pcre: avoid overflow in PCRE JIT stack resizing)

From: [email-masked] (GNU bug Tracking System)
Date: Tue, 09 Nov 2021 18:29:01 +0000

Your bug report

#51710: [PATCH] pcre: avoid overflow in PCRE JIT stack resizing

which was filed against the grep package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
51710: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=51710
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#51710: [PATCH] pcre: avoid overflow in PCRE JIT stack resizing
From: Paul Eggert <[email-masked]>
To: Carlo Marcelo Arenas Belón <[email-masked]>
Cc: [email-masked]
Date: Tue, 9 Nov 2021 10:28:07 -0800
List-Id: <debbugs-submit.debbugs.gnu.org>

Thanks for reporting that. I installed the attached somewhat-simpler patch.

Does PCRE2 have a similar bug? If so, I suppose this should be reflected 
when we merge in the patch for bug#47264.

From f87b649c9157f60a09af4c2596288704e0057358 Mon Sep 17 00:00:00 2001
From: Paul Eggert <[email-masked]>
Date: Tue, 9 Nov 2021 10:11:42 -0800
Subject: [PATCH] grep: work around PCRE bug
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Problem reported by Carlo Marcelo Arenas Belón (Bug#51710).
* src/pcresearch.c (jit_exec): Don’t attempt to grow the JIT stack
over INT_MAX - 8 * 1024.
---
 src/pcresearch.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/pcresearch.c b/src/pcresearch.c
index 3bdaee9..09f92c8 100644
--- a/src/pcresearch.c
+++ b/src/pcresearch.c
@@ -72,8 +72,11 @@ jit_exec (struct pcre_comp *pc, char const *subject, int search_bytes,
                          search_offset, options, sub, NSUB);
 
 #if PCRE_STUDY_JIT_COMPILE
+      /* Going over this would trigger an int overflow bug within PCRE.  */
+      int jitstack_max = INT_MAX - 8 * 1024;
+
       if (e == PCRE_ERROR_JIT_STACKLIMIT
-          && 0 < pc->jit_stack_size && pc->jit_stack_size <= INT_MAX / 2)
+          && 0 < pc->jit_stack_size && pc->jit_stack_size <= jitstack_max / 2)
         {
           int old_size = pc->jit_stack_size;
           int new_size = pc->jit_stack_size = old_size * 2;
-- 
2.32.0

Subject: [PATCH] pcre: avoid overflow in PCRE JIT stack resizing
From: Carlo Marcelo Arenas Belón <[email-masked]>
To: [email-masked]
Cc: Carlo Marcelo Arenas Belón <[email-masked]>
Date: Tue, 9 Nov 2021 00:33:09 -0800
List-Id: <debbugs-submit.debbugs.gnu.org>

fbc60d4 (Grow the JIT stack if it becomes exhausted, 2015-02-10), add
support to grep for recovering from a JIT stack exhaustion problem,
by creating and using increasingly larger stacks.

The underlying problem might seem to have been generated by a PCRE bug
that is no longer reproducible, and the code could be simplified to do
a single iteration instead with a theoretical maximum of almost INT_MAX,
but that could be a regression, so instead make sure that the maximum
size requested will always be valid, by avoiding a PCRE internal int
overflow that will then be translated into an UINT_MAX like value by
sljit.

Alternatively, a smaller maximum could be selected as it has been
documented[1] that more than 1MB would be unrealistic.

[1] https://www.pcre.org/original/doc/html/pcrejit.html#SEC8

Signed-off-by: Carlo Marcelo Arenas Belón <[email-masked]>
---
 src/pcresearch.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/pcresearch.c b/src/pcresearch.c
index 3bdaee9..c4fb09b 100644
--- a/src/pcresearch.c
+++ b/src/pcresearch.c
@@ -77,6 +77,10 @@ jit_exec (struct pcre_comp *pc, char const *subject, int search_bytes,
         {
           int old_size = pc->jit_stack_size;
           int new_size = pc->jit_stack_size = old_size * 2;
+
+          /* PCRE will round up 8K bytes, so avoid overflow in maximum  */
+          if (INT_MAX - new_size < 8192)
+            new_size = INT_MAX - 8192;
           if (pc->jit_stack)
             pcre_jit_stack_free (pc->jit_stack);
           pc->jit_stack = pcre_jit_stack_alloc (old_size, new_size);
-- 
2.34.0.rc1.349.g8f33748433