From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by sourceware.org (Postfix) with ESMTPS id 43C37385770F for ; Thu, 18 May 2023 14:08:35 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 43C37385770F Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1684418914; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=hAnE1cBOWwlrodzy2PDlmef8ZPrlbNI1tg3KqWhNup4=; b=J/7cUhh51RnIrHcChZFH8iwEa57/aax3B3ZyBEdv2jtVgjH6+oSFGr30uiseZEKiFzSr2p lK5hK+bI8VABsRFRN2LVa+dbZjlhd8bgsswm2DXTE6BdXRacu5fnsKHzyLnp1fkFsHIobb kniY00VZXVdzrihyLZHS59q8FOCFk/A= Received: from mail-yb1-f198.google.com (mail-yb1-f198.google.com [209.85.219.198]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-665-sT3nDDBlO6-43kUBiAa7UA-1; Thu, 18 May 2023 10:08:33 -0400 X-MC-Unique: sT3nDDBlO6-43kUBiAa7UA-1 Received: by mail-yb1-f198.google.com with SMTP id 3f1490d57ef6-b9a25f6aa0eso3919409276.1 for ; Thu, 18 May 2023 07:08:33 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1684418913; x=1687010913; h=content-transfer-encoding:in-reply-to:organization:from:references :to:content-language:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=hAnE1cBOWwlrodzy2PDlmef8ZPrlbNI1tg3KqWhNup4=; b=LUzC7NZ9+0mOM1g5jlysKQKHZnHpbturn54zGllZ7uz2HZ3C9UPVzfykq52xd4gxgg FKaD89YBEqcZhGp0MoFWacOMNmVyTSLGhCAQg05M1VW5RWVEb4WgGGkMvmGs2lwVYJQ6 uAVc2iu7cMwflA9dmHra0ypDEHCbRJ+85791a5WI3ZUoXJ1JMgmXdKmjtJplPJWV3DUe Ge+udxnOhQXuI7Hy0sUw/3PQ4D1J6GbRyk4Rx8I9/VZGSJRseV+JasQVzHIpza6S/MPq NiY9IZGgr+/HZn3JYzpdCL6oCGehR10c7Bpp7gBCf4gOXqzGX+BhmnZ1Vi5c7BlCvXre 74kA== X-Gm-Message-State: AC+VfDygw6FcpjPcY3ESpNpdeZPhoxxrxtrT1J+ytz6lLWwuG7Xs5MHz xUVb1swYqh9MDF8Qlzdquh1nPWTtV23bKlWd7ck9/wQ8vVCowNz3lSOVPam45nmnHn6rPTSoOvy QHp3VCoc6grAS7+UKDDLI X-Received: by 2002:a25:6a06:0:b0:ba6:b00d:b865 with SMTP id f6-20020a256a06000000b00ba6b00db865mr1046904ybc.56.1684418912985; Thu, 18 May 2023 07:08:32 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ6QEe5iG5s/5GucVkfqjeqgD8KArwW6odGaBHPiEIPArU4jk4/byJVDiut+pcEtD1W/e/MfHQ== X-Received: by 2002:a25:6a06:0:b0:ba6:b00d:b865 with SMTP id f6-20020a256a06000000b00ba6b00db865mr1046878ybc.56.1684418912558; Thu, 18 May 2023 07:08:32 -0700 (PDT) Received: from [192.168.0.241] ([198.48.244.52]) by smtp.gmail.com with ESMTPSA id b2-20020a816702000000b0054605c23114sm436384ywc.66.2023.05.18.07.08.31 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 18 May 2023 07:08:32 -0700 (PDT) Message-ID: Date: Thu, 18 May 2023 10:08:31 -0400 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.10.0 Subject: Re: [PATCH] vfprintf-internal: Get rid of alloca. To: Joe Simmons-Talbott , libc-alpha@sourceware.org References: <20230517212847.1821277-1-josimmon@redhat.com> From: Carlos O'Donell Organization: Red Hat In-Reply-To: <20230517212847.1821277-1-josimmon@redhat.com> X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Language: en-US Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-14.0 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,GIT_PATCH_0,NICE_REPLY_A,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_NONE,TXREP,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: On 5/17/23 17:28, Joe Simmons-Talbott via Libc-alpha wrote: > Avoid potential stack overflow from unbounded alloca. Use the existing > scratch_buffer instead. Fails 32-bit i686 CI: https://patchwork.sourceware.org/project/glibc/patch/20230517212847.1821277-1-josimmon@redhat.com/ Please have a look. > --- > stdio-common/vfprintf-internal.c | 22 +++++++++++++++++++++- > 1 file changed, 21 insertions(+), 1 deletion(-) > > diff --git a/stdio-common/vfprintf-internal.c b/stdio-common/vfprintf-internal.c > index c76c06e49b..baaefb763a 100644 > --- a/stdio-common/vfprintf-internal.c > +++ b/stdio-common/vfprintf-internal.c > @@ -1066,6 +1066,8 @@ printf_positional (struct Xprintf_buffer * buf, const CHAR_T *format, > union printf_arg *args_value; > int *args_size; > int *args_type; > + int *args_pa_user; > + size_t args_pa_user_offset; > { > /* Calculate total size needed to represent a single argument > across all three argument-related arrays. */ > @@ -1082,6 +1084,7 @@ printf_positional (struct Xprintf_buffer * buf, const CHAR_T *format, > now. */ > args_size = &args_value[nargs].pa_int; > args_type = &args_size[nargs]; > + args_pa_user = &args_type[nargs]; > memset (args_type, (mode_flags & PRINTF_FORTIFY) != 0 ? '\xff' : '\0', > nargs * sizeof (*args_type)); > } > @@ -1171,7 +1174,24 @@ printf_positional (struct Xprintf_buffer * buf, const CHAR_T *format, > else if (__glibc_unlikely (__printf_va_arg_table != NULL) > && __printf_va_arg_table[args_type[cnt] - PA_LAST] != NULL) > { > - args_value[cnt].pa_user = alloca (args_size[cnt]); > + if (args_pa_user > argsbuf + args_size) > + { > + args_pa_user_offset = args_pa_user - &args_type[nargs]; > + if (!scratch_buffer_grow_preserve (&argsbuf)) > + { > + Xprintf_buffer_mark_failed (buf); > + goto all_done; > + } > + args_value = argsbuf.data; > + /* Set up the remaining two arrays to each point past the end of > + the prior array, since space for all three has been allocated > + now. */ > + args_size = &args_value[nargs].pa_int; > + args_type = &args_size[nargs]; > + args_pa_user = &args_type[nargs] + args_pa_user_offset; > + } > + args_value[cnt].pa_user = args_pa_user; > + args_pa_user += args_size[cnt]; > (*__printf_va_arg_table[args_type[cnt] - PA_LAST]) > (args_value[cnt].pa_user, ap_savep); > } -- Cheers, Carlos.