From: Nick Clifton <nickc@redhat.com>
To: Jakub Jelinek <jakub@redhat.com>
Cc: Michael Matz <matz@suse.de>, Ian Lance Taylor <iant@google.com>,
"H.J. Lu" <hjl.tools@gmail.com>, Pedro Alves <palves@redhat.com>,
Richard Guenther <richard.guenther@gmail.com>,
sgayou@redhat.com, Tom Tromey <tom@tromey.com>,
GCC Patches <gcc-patches@gcc.gnu.org>,
Binutils <binutils@sourceware.org>,
Jason Merrill <jason@redhat.com>
Subject: Re: [PATCH] Set DEMANGLE_RECURSION_LIMIT to 1536
Date: Mon, 10 Dec 2018 15:26:00 -0000 [thread overview]
Message-ID: <0af34ffd-e894-2803-7c4e-eac4d9ffb385@redhat.com> (raw)
In-Reply-To: <20181210151846.GB12380@tucnak>
Hi Jakub,
>> My current suggestion
>> is to raise the limit to 2048, which allows the libiberty patch to
>> pass. But do you have a feel for how much is a realistic limit ?
>
> For recursion limit I think that is fine.
> For just stack size limit, I think it is extremely small.
> I see that in the function it allocates on 64-bit 24 bytes times
> num_comps using alloca, so 48 bytes per character in the mangled name,
> and a pointer for each character in the mangled name.
> That is 112KB per 2048 bytes long mangled name.
>
> Dunno how much stack can we expect to be usable.
Currently the patched libiberty uses the DEMANGLE_RECURSION_LIMIT value
in two ways. The first is as a limit on the number of levels of recursion
of specific functions inside the demangler. The second is as a check on
the number of component structures that will be allocated on the stack.
(See cp-demangle.c:d_demangle_callback). One of the CVEs that I was checking
was triggering stack exhaustion this way, which is why I added the check.
There is at least one other function where a similar stack allocation
happens (cplus_demangle_print_callback) but I was not sure if this could
be triggered with the other limits in place, and I did not have a reproducer
that touched it, so I left it alone.
Cheers
Nick
next prev parent reply other threads:[~2018-12-10 15:26 UTC|newest]
Thread overview: 55+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-11-30 8:38 RFA/RFC: Add stack recursion limit to libiberty's demangler Nick Clifton
2018-11-30 8:42 ` Jakub Jelinek
2018-11-30 10:27 ` Nick Clifton
2018-11-30 13:46 ` Michael Matz
2018-11-30 14:57 ` Ian Lance Taylor
2018-12-02 0:49 ` Cary Coutant
2018-12-03 14:53 ` Nick Clifton
2018-12-03 22:00 ` Joseph Myers
2018-11-30 13:56 ` Ian Lance Taylor
2018-11-30 14:03 ` Jakub Jelinek
2018-11-30 17:41 ` RFA/RFC: Add stack recursion limit to libiberty's demangler [v3] Nick Clifton
2018-11-30 17:49 ` Jakub Jelinek
2018-11-30 18:19 ` Pedro Alves
2018-12-03 10:28 ` Richard Biener
2018-12-03 14:45 ` Nick Clifton
2018-12-03 18:49 ` Ian Lance Taylor via gcc-patches
2018-12-04 14:00 ` RFA/RFC: Add stack recursion limit to libiberty's demangler [v4] Nick Clifton
2018-12-04 15:02 ` Pedro Alves
2018-12-04 16:57 ` RFA/RFC: Add stack recursion limit to libiberty's demangler [v5] Nick Clifton
2018-12-04 17:08 ` Pedro Alves
2018-12-06 11:12 ` Nick Clifton
2018-12-06 18:04 ` Ian Lance Taylor via gcc-patches
2018-12-07 16:17 ` H.J. Lu
2018-12-07 16:25 ` [PATCH] Set DEMANGLE_RECURSION_LIMIT to 1536 H.J. Lu
2018-12-10 14:52 ` Michael Matz
2018-12-10 15:10 ` Jakub Jelinek
2018-12-10 15:34 ` Jason Merrill
2018-12-11 0:33 ` Jeff Law
2018-12-11 6:58 ` Jakub Jelinek
2018-12-11 11:05 ` Pedro Alves
2018-12-11 14:26 ` Ian Lance Taylor via gcc-patches
2018-12-11 15:07 ` Pedro Alves
2018-12-11 10:34 ` Pedro Alves
2018-12-10 15:12 ` Nick Clifton
2018-12-10 15:18 ` Jakub Jelinek
2018-12-10 15:26 ` Nick Clifton [this message]
2018-12-10 15:35 ` Jakub Jelinek
2018-12-10 18:20 ` Ian Lance Taylor via gcc-patches
2018-12-10 18:55 ` Jakub Jelinek
2018-12-10 23:47 ` Jason Merrill
2018-12-10 15:18 ` David Malcolm
2018-12-10 15:31 ` Nick Clifton
2018-12-06 16:14 ` RFA/RFC: Add stack recursion limit to libiberty's demangler [v5] Jason Merrill
2018-12-06 21:22 ` RFC: libiberty PATCH to disable demangling of ancient mangling schemes Jason Merrill
2018-12-07 10:27 ` Nick Clifton
2018-12-07 10:40 ` Jakub Jelinek
2018-12-07 16:11 ` Pedro Alves
2018-12-07 17:49 ` Tom Tromey
2018-12-07 21:00 ` Jason Merrill
2018-12-14 22:39 ` Jason Merrill
2018-12-16 4:50 ` Simon Marchi
2018-12-07 16:28 ` Nick Clifton
2018-12-07 11:37 ` Richard Biener
2018-12-07 15:49 ` Jason Merrill
2018-12-10 1:04 ` Eric Gallager
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0af34ffd-e894-2803-7c4e-eac4d9ffb385@redhat.com \
--to=nickc@redhat.com \
--cc=binutils@sourceware.org \
--cc=gcc-patches@gcc.gnu.org \
--cc=hjl.tools@gmail.com \
--cc=iant@google.com \
--cc=jakub@redhat.com \
--cc=jason@redhat.com \
--cc=matz@suse.de \
--cc=palves@redhat.com \
--cc=richard.guenther@gmail.com \
--cc=sgayou@redhat.com \
--cc=tom@tromey.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).