From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 23E21C06017; Mon, 26 Aug 2024 13:25:29 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 23E21C06017 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1724667929; bh=7roC3h2f+v5bKtAF+rrt24CXAKA11+Ytnlo0NBiT3dI=; h=To:Date:Subject:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:Cc:From; b=Z38fSpemCnjC7mpVdZ4PTDIIxRkdbTbSxL/K50HJU5osQtiWOCkAG5SmmiBe39fjW c8Bqn5OjhrS82rqI20flXUAix/BPWbz4tbF2fT4K5ApZFnWNmRXAVNpiuXE6X1hpL0 Gulcz+BABMddAlQ1+VACzvOlf29NR9rPBxt4xvtQ= Received: from smtp45.i.mail.ru (smtp45.i.mail.ru [95.163.41.83]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 869F4C06018 for ; Mon, 26 Aug 2024 13:25:27 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 869F4C06018 Received: by smtp45.i.mail.ru with esmtpa (envelope-from ) id 1siWuc-0000000Ed3D-2uEK; Mon, 26 Aug 2024 13:25:27 +0300 To: Maxim Kokryashkin , Sergey Bronnikov Date: Mon, 26 Aug 2024 13:25:20 +0300 Message-ID: <20240826102520.29541-1-skaplun@tarantool.org> X-Mailer: git-send-email 2.46.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Mailru-Src: smtp X-7564579A: EEAE043A70213CC8 X-77F55803: 4F1203BC0FB41BD9604F665CF1C84C299E6D8E1CC684B50B3F077263C41BE8DD182A05F5380850404C228DA9ACA6FE276E353036F471715403ED270C30F246C5A405FCAC14BDFA4BF44C95E099AA1FE7377EF39409332766 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE7978947DCA0D4215FEA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F79006372457B5C794CE26728638F802B75D45FF36EB9D2243A4F8B5A6FCA7DBDB1FC311F39EFFDF887939037866D6147AF826D8DBA21151EB1B7393B4C6F71F8CA12D794EF399F0F5C9B444CC7F00164DA146DAFE8445B8C89999728AA50765F7900637CAEE156C82D3D7D9389733CBF5DBD5E9C8A9BA7A39EFB766F5D81C698A659EA7CC7F00164DA146DA9985D098DBDEAEC80CABCCA60F52D7EBF6B57BC7E6449061A352F6E88A58FB86F5D81C698A659EA7E827F84554CEF5019E625A9149C048EE9ECD01F8117BC8BEE2021AF6380DFAD18AA50765F790063735872C767BF85DA227C277FBC8AE2E8BAEB924C2B054B06E75ECD9A6C639B01B4E70A05D1297E1BBCB5012B2E24CD356 X-C1DE0DAB: 0D63561A33F958A5FDC92BED9B361A595002B1117B3ED696594CDF9CAAABC097AD0703CEB2EF9A27823CB91A9FED034534781492E4B8EEAD3C056C6FCE5AFF8EC79554A2A72441328621D336A7BC284946AD531847A6065A535571D14F44ED41 X-C8649E89: 1C3962B70DF3F0ADE00A9FD3E00BEEDF77DD89D51EBB7742D3581295AF09D3DF87807E0823442EA2ED31085941D9CD0AF7F820E7B07EA4CF25D949EC69AEC374524720CDFE8DB1B4A8F1211A0B5698D3DBB6DA1A5EC12AFF08FC8DA71D3854888CBD875B35315F9AD916E8F6EB36F1258C933E9D92B23ED29C5748AC20795581C226CC413062362A913E6812662D5F2A5EAB5682573093F7837F15F2B5E4A70B33F2C28C22F508233FCF178C6DD14203 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2biojPokOeLnI1rvvgOyJ3vjhLg== X-DA7885C5: F23214D761A5E3BFF255D290C0D534F9F9E030FFC0DE21D20679F32897516A930706E344C7F7F0C95B1A4C17EAA7BC4BEF2421ABFA55128DAF83EF9164C44C7E X-Mailru-Sender: 689FA8AB762F7393C6D0B12EA33CAA9B2899AEE9E84ADC54F36FD2E651C3E73F27BA97D52C6E93DCE49D44BB4BD9522A059A1ED8796F048DB274557F927329BE89D5A3BC2B10C37545BD1C3CC395C826B4A721A3011E896F X-Mras: Ok Subject: [Tarantool-patches] [PATCH luajit] Limit number of string format elements to compile. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" From: Mike Pall Reported by pwnhacker0x18. (cherry picked from commit 4fc48c50fe3f3f5a9680bada5c0c0d0d7eb345a3) When compiling `string.format()` with a huge sequence of elements, it is possible that too many KGC IRs underflow the IR buffer. This patch limits the maximum number of `string.format()` elements to be compiled to 100. Sergey Kaplun: * added the description and the test for the problem Part of tarantool/tarantool#10199 --- Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-1203-limit-format-elements Related issues: * https://github.com/tarantool/tarantool/issues/10199 * https://github.com/LuaJIT/LuaJIT/issues/1203 src/lj_ffrecord.c | 2 ++ .../lj-1203-limit-format-elements.test.lua | 28 +++++++++++++++++++ 2 files changed, 30 insertions(+) create mode 100644 test/tarantool-tests/lj-1203-limit-format-elements.test.lua diff --git a/src/lj_ffrecord.c b/src/lj_ffrecord.c index d5fc081e..3b82d044 100644 --- a/src/lj_ffrecord.c +++ b/src/lj_ffrecord.c @@ -962,6 +962,7 @@ static void LJ_FASTCALL recff_string_format(jit_State *J, RecordFFData *rd) TRef hdr, tr; FormatState fs; SFormat sf; + int nfmt = 0; /* Specialize to the format string. */ emitir(IRTG(IR_EQ, IRT_STR), trfmt, lj_ir_kstr(J, fmt)); tr = hdr = recff_bufhdr(J); @@ -1031,6 +1032,7 @@ static void LJ_FASTCALL recff_string_format(jit_State *J, RecordFFData *rd) recff_nyiu(J, rd); return; } + if (++nfmt > 100) lj_trace_err(J, LJ_TRERR_TRACEOV); } J->base[0] = emitir(IRT(IR_BUFSTR, IRT_STR), tr, hdr); } diff --git a/test/tarantool-tests/lj-1203-limit-format-elements.test.lua b/test/tarantool-tests/lj-1203-limit-format-elements.test.lua new file mode 100644 index 00000000..f17d4e37 --- /dev/null +++ b/test/tarantool-tests/lj-1203-limit-format-elements.test.lua @@ -0,0 +1,28 @@ +local tap = require('tap') + +-- Test file to demonstrate LuaJIT incorrect recording of +-- `string.format()` function with huge amount of elements. +-- See also: https://github.com/LuaJIT/LuaJIT/issues/1173. + +local test = tap.test('lj-1203-limit-format-elements'):skipcond({ + ['Test requires JIT enabled'] = not jit.status(), +}) + +test:plan(2) + +jit.opt.start('hotloop=1') + +-- XXX: Use a huge amount of format elements to process, which +-- creates a lot of string constants. +local NELEMENTS = 25000 +local fmt = ('%'):rep(NELEMENTS * 2) +local expected = ('%'):rep(NELEMENTS) +local result +for _ = 1, 4 do + result = fmt:format() +end + +test:ok(true, 'no IR buffer underflow') +test:is(result, expected, 'correct result') + +test:done(true) -- 2.46.0