Project

General

Profile

Bug #9608

[PATCH] avoid large alloca on Complex/Rational calls

Added by Eric Wong about 2 years ago. Updated almost 2 years ago.

Status:
Closed
Priority:
Normal
ruby -v:
ruby 2.2.0dev (2014-03-07 trunk 45281) [x86_64-linux]
[ruby-core:61357]

Description

  • complex.c (parse_comp): replace ALLOCA_N with ALLOCV_N/ALLOCV_END
  • rational.c (read_digits): ditto

This fixes segfaults on:

Rational("1" * 16 * 1024 * 1024)
Complex("1" * 16 * 1024 * 1024)

On my system where my stack size is only 8M.

tadf: Should we raise an exception on large string instead?
Large strings are slow to parse and could still be a DoS.

0001-avoid-large-alloca-on-Complex-Rational-calls.patch Magnifier (1.86 KB) Eric Wong, 03/07/2014 09:56 AM

Associated revisions

Revision 45793
Added by normal almost 2 years ago

avoid large alloca on Complex/Rational calls

  • complex.c (parse_comp): replace ALLOCA_N with ALLOCV_N/ALLOCV_END [Bug #9608]
  • rational.c (read_digits): ditto

Revision 45793
Added by normal almost 2 years ago

avoid large alloca on Complex/Rational calls

  • complex.c (parse_comp): replace ALLOCA_N with ALLOCV_N/ALLOCV_END [Bug #9608]
  • rational.c (read_digits): ditto

Revision 45793
Added by normal almost 2 years ago

avoid large alloca on Complex/Rational calls

  • complex.c (parse_comp): replace ALLOCA_N with ALLOCV_N/ALLOCV_END [Bug #9608]
  • rational.c (read_digits): ditto

Revision 46578
Added by Usaku NAKAMURA almost 2 years ago

merge revision(s) 45793: [Backport #9608]

* complex.c (parse_comp): replace ALLOCA_N with ALLOCV_N/ALLOCV_END
  [Bug #9608]

* rational.c (read_digits): ditto

Revision 46612
Added by Tomoyuki Chikanaga almost 2 years ago

merge revision(s) r45793: [Backport #9608]

* complex.c (parse_comp): replace ALLOCA_N with ALLOCV_N/ALLOCV_END
  [Bug #9608]

* rational.c (read_digits): ditto

History

#2 [ruby-core:61761] Updated by Eric Wong about 2 years ago

tadf: ping?

#3 [ruby-core:62292] Updated by tadayoshi funaba almost 2 years ago

i'd like to try it; please commit it.

#4 Updated by Anonymous almost 2 years ago

  • Status changed from Open to Closed
  • % Done changed from 0 to 100

Applied in changeset r45793.


avoid large alloca on Complex/Rational calls

  • complex.c (parse_comp): replace ALLOCA_N with ALLOCV_N/ALLOCV_END [Bug #9608]
  • rational.c (read_digits): ditto

#5 [ruby-core:63358] Updated by Usaku NAKAMURA almost 2 years ago

  • Backport changed from 1.9.3: UNKNOWN, 2.0.0: REQUIRED, 2.1: REQUIRED to 1.9.3: UNKNOWN, 2.0.0: DONE, 2.1: REQUIRED

backported into ruby_2_0_0 at r46578.

#6 [ruby-core:63403] Updated by Tomoyuki Chikanaga almost 2 years ago

  • Backport changed from 1.9.3: UNKNOWN, 2.0.0: DONE, 2.1: REQUIRED to 1.9.3: UNKNOWN, 2.0.0: DONE, 2.1: DONE

Backported into ruby_2_1 at r46612.

Also available in: Atom PDF