Bug #9608

[PATCH] avoid large alloca on Complex/Rational calls

Added by Eric Wong about 1 year ago. Updated 10 months ago.

[ruby-core:61357]
Status:Closed
Priority:Normal
Assignee:tadayoshi funaba
ruby -v:ruby 2.2.0dev (2014-03-07 trunk 45281) [x86_64-linux] Backport:1.9.3: UNKNOWN, 2.0.0: DONE, 2.1: DONE

Description

  • complex.c (parse_comp): replace ALLOCA_N with ALLOCV_N/ALLOCV_END
  • rational.c (read_digits): ditto

This fixes segfaults on:

Rational("1" * 16 * 1024 * 1024)
Complex("1" * 16 * 1024 * 1024)

On my system where my stack size is only 8M.

tadf: Should we raise an exception on large string instead?
Large strings are slow to parse and could still be a DoS.

0001-avoid-large-alloca-on-Complex-Rational-calls.patch Magnifier (1.86 KB) Eric Wong, 03/07/2014 09:56 AM

Associated revisions

Revision 45793
Added by normal about 1 year ago

avoid large alloca on Complex/Rational calls

  • complex.c (parse_comp): replace ALLOCA_N with ALLOCV_N/ALLOCV_END [Bug #9608]
  • rational.c (read_digits): ditto

Revision 45793
Added by normal about 1 year ago

avoid large alloca on Complex/Rational calls

  • complex.c (parse_comp): replace ALLOCA_N with ALLOCV_N/ALLOCV_END [Bug #9608]
  • rational.c (read_digits): ditto

Revision 46578
Added by Usaku NAKAMURA 10 months ago

merge revision(s) 45793: [Backport #9608]

* complex.c (parse_comp): replace ALLOCA_N with ALLOCV_N/ALLOCV_END
  [Bug #9608]

* rational.c (read_digits): ditto

Revision 46612
Added by Tomoyuki Chikanaga 10 months ago

merge revision(s) r45793: [Backport #9608]

* complex.c (parse_comp): replace ALLOCA_N with ALLOCV_N/ALLOCV_END
  [Bug #9608]

* rational.c (read_digits): ditto

History

#2 Updated by Eric Wong about 1 year ago

tadf: ping?

#3 Updated by tadayoshi funaba about 1 year ago

i'd like to try it; please commit it.

#4 Updated by Anonymous about 1 year ago

  • Status changed from Open to Closed
  • % Done changed from 0 to 100

Applied in changeset r45793.


avoid large alloca on Complex/Rational calls

  • complex.c (parse_comp): replace ALLOCA_N with ALLOCV_N/ALLOCV_END [Bug #9608]
  • rational.c (read_digits): ditto

#5 Updated by Usaku NAKAMURA 10 months ago

  • Backport changed from 1.9.3: UNKNOWN, 2.0.0: REQUIRED, 2.1: REQUIRED to 1.9.3: UNKNOWN, 2.0.0: DONE, 2.1: REQUIRED

backported into ruby_2_0_0 at r46578.

#6 Updated by Tomoyuki Chikanaga 10 months ago

  • Backport changed from 1.9.3: UNKNOWN, 2.0.0: DONE, 2.1: REQUIRED to 1.9.3: UNKNOWN, 2.0.0: DONE, 2.1: DONE

Backported into ruby_2_1 at r46612.

Also available in: Atom PDF