From patchwork Wed Dec 14 23:39:21 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?b?0L3QsNCx?= X-Patchwork-Id: 13073728 X-Patchwork-Delegate: herbert@gondor.apana.org.au Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8105FC4332F for ; Wed, 14 Dec 2022 23:39:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229454AbiLNXjk (ORCPT ); Wed, 14 Dec 2022 18:39:40 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37512 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229560AbiLNXj0 (ORCPT ); Wed, 14 Dec 2022 18:39:26 -0500 Received: from tarta.nabijaczleweli.xyz (unknown [139.28.40.42]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 2352945ECE for ; Wed, 14 Dec 2022 15:39:24 -0800 (PST) Received: from tarta.nabijaczleweli.xyz (unknown [192.168.1.250]) by tarta.nabijaczleweli.xyz (Postfix) with ESMTPSA id 53E7D11CE for ; Thu, 15 Dec 2022 00:39:22 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nabijaczleweli.xyz; s=202211; t=1671061162; bh=V0fmCYd5hkH1lJ/FQEM82C+izDClEDfEej2OgVWDYyY=; h=Date:From:To:Subject:From; b=MZgdrDSYMTnVCgYdFu+CenJ8JN2cdhkYr27ph1Nyx0yb+FytjMycJBWhSMdgGl8h9 4CIM5LOT/T2doVSTxf3YJTwbqxzFSAXBNLNPZAkEiKhWjY/4f/JAgMjW55OaTX2on7 UvlWgi+UnSDB66yxjhZTCRUUZ+r4vY9LLQB8D7HzzYJGn/yDJ+uKOboYQAie5ieEXq gbDGhtsUE2btspcyFQV9V7X99FQLX7OJk+4c86jV4J57JdE2uH6jx9YQ2NoPa1KAew 8wZdOMX+LsJeIpGXTtDVXtn1pPuc9LqeBxlJyX+82LdFTL1AOpdWuWQYONXy+vYqDE VJPBSp4YcldDA== Date: Thu, 15 Dec 2022 00:39:21 +0100 From: =?utf-8?b?0L3QsNCx?= To: dash@vger.kernel.org Subject: [PATCH] parser: don't keep alloca()ing in a loop for substitutions Message-ID: <20221214233921.m6hpt5a6kb3wgyjl@tarta.nabijaczleweli.xyz> MIME-Version: 1.0 Content-Disposition: inline User-Agent: NeoMutt/20220429 Precedence: bulk List-ID: X-Mailing-List: dash@vger.kernel.org When encountering printf %010000d | tr 0 \` | sh -n printf %09999d | tr 0 \` | sh -n you want no output and "Syntax error: EOF in backquote substitution", respectively; instead, current dash segfaults. This is because the alloca for the save buffer is run, naturally, in the same function, so first it allocates one byte, then two, then ..., then appx. 4000 (for me, depends on the binary), then it segfaults on the memcpy (it's even worse, since due to alignment, it usually allocates much more for the early stuff). Nevertheless, the stack frame grows unboundedly, until we completely destroy the stack. Instead, alloca a 1KiB buffer on first use and fall back to ckmalloc for bigger save buffers. In practice this means that we'll alloca nothing in a good amount of cases, then just about always use the alloca buffer except for truly pathological input. Fixes: https://bugs.debian.org/966156 --- src/parser.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/src/parser.c b/src/parser.c index a552c47..3f7e50a 100644 --- a/src/parser.c +++ b/src/parser.c @@ -898,6 +898,7 @@ readtoken1(int firstc, char const *syntax, char *eofmark, int striptabs) struct nodelist *bqlist; int quotef; int oldstyle; + char *parsebackq_save; /* syntax stack */ struct synstack synbase = { .syntax = syntax }; struct synstack *synstack = &synbase; @@ -906,6 +907,7 @@ readtoken1(int firstc, char const *syntax, char *eofmark, int striptabs) synstack->dblquote = 1; quotef = 0; bqlist = NULL; + parsebackq_save = NULL; STARTSTACKSTR(out); loop: { /* for each line, until end of word */ @@ -1355,15 +1357,18 @@ badsub: parsebackq: { struct nodelist **nlpp; union node *n; - char *str; + char *str, *mstr; size_t savelen; struct heredoc *saveheredoclist; int uninitialized_var(saveprompt); - str = NULL; + str = mstr = NULL; savelen = out - (char *)stackblock(); if (savelen > 0) { - str = alloca(savelen); + if (savelen > 1024) + str = mstr = ckmalloc(savelen); + else + str = parsebackq_save ?: (parsebackq_save = alloca(1024)); memcpy(str, stackblock(), savelen); } if (oldstyle) { @@ -1449,6 +1454,7 @@ done: if (str) { memcpy(out, str, savelen); STADJUST(savelen, out); + free(mstr); } USTPUTC(CTLBACKQ, out); if (oldstyle)