Skip to content

Stack overflow fix #236

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 5 commits into from
Closed

Stack overflow fix #236

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
b88715e
add clang 16-18 with sanitization
cmazakas Dec 9, 2024
f4129c0
fix negation operator creating an enum with an invalid value
cmazakas Dec 9, 2024
26b0853
use manual pointer arithmetic to avoid invalid pointer cast
cmazakas Dec 9, 2024
1cc781b
fix stack overflow found by fuzzing
cmazakas Dec 11, 2024
c3f1251
update fuzzing jamfile for modern clang and fuzzers
cmazakas Dec 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 55 additions & 2 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
# (See accompanying file LICENSE_1_0.txt or copy at http://boost.org/LICENSE_1_0.txt)

name: CI

on:
push:
branches:
Expand All @@ -13,6 +14,10 @@ on:
pull_request:
release:
types: [published, created, edited]

env:
UBSAN_OPTIONS: print_stacktrace=1

jobs:
ubuntu-jammy:
runs-on: ubuntu-22.04
Expand Down Expand Up @@ -60,7 +65,7 @@ jobs:
run: ../../../b2 print_config_info toolset=$TOOLSET
working-directory: ../boost-root/libs/config/test
- name: Test
run: ../../../b2 toolset=$TOOLSET
run: ../../../b2 toolset=$TOOLSET variant=debug,release ${{ startsWith(matrix.compiler, 'g++-13') && 'address-sanitizer=norecover undefined-sanitizer=norecover' || '' }}
working-directory: ../boost-root/libs/regex/test
ubuntu-jammy-standalone:
runs-on: ubuntu-22.04
Expand Down Expand Up @@ -135,6 +140,54 @@ jobs:
- name: Test
run: ../../../b2 toolset=$TOOLSET define=CI_SUPPRESS_KNOWN_ISSUES define=SLOW_COMPILER
working-directory: ../boost-root/libs/regex/test
ubuntu-noble-clang:
runs-on: ubuntu-24.04
strategy:
fail-fast: false
matrix:
compiler: [ clang++-16, clang++-17, clang++-18 ]
standard: [ c++11, c++14, c++17, c++20 ]
steps:
- uses: actions/checkout@v2
with:
fetch-depth: '0'
- uses: mstachniuk/ci-skip@v1
with:
commit-filter: '[skip ci];[ci skip];[CI SKIP];[SKIP CI];***CI SKIP***;***SKIP CI***;[windows];[Windows];[WINDOWS];[apple];[Apple];[APPLE]'
commit-filter-separator: ';'
fail-fast: true
- name: Set TOOLSET
run: echo ${{ matrix.compiler }} | awk '/^g/ { print "TOOLSET=gcc" } /^clang/ { print "TOOLSET=clang" }' >> $GITHUB_ENV
- name: Add repository
run: sudo apt-add-repository -y "ppa:ubuntu-toolchain-r/test"
- name: Install packages
run: sudo apt install clang-16 clang-17 clang-18
- name: Checkout main boost
run: git clone -b develop --depth 1 https://github.com/boostorg/boost.git ../boost-root
- name: Update tools/boostdep
run: git submodule update --init tools/boostdep
working-directory: ../boost-root
- name: Copy files
run: cp -r $GITHUB_WORKSPACE/* libs/regex
working-directory: ../boost-root
- name: Install deps
run: python tools/boostdep/depinst/depinst.py -I example -g "--jobs 3" regex
working-directory: ../boost-root
- name: Bootstrap
run: ./bootstrap.sh
working-directory: ../boost-root
- name: Generate headers
run: ./b2 headers
working-directory: ../boost-root
- name: Generate user config
run: 'echo "using $TOOLSET : : ${{ matrix.compiler }} : <cxxflags>-std=${{ matrix.standard }} ;" > ~/user-config.jam'
working-directory: ../boost-root
- name: Config info
run: ../../../b2 print_config_info toolset=$TOOLSET
working-directory: ../boost-root/libs/config/test
- name: Test
run: ../../../b2 toolset=$TOOLSET define=CI_SUPPRESS_KNOWN_ISSUES define=SLOW_COMPILER variant=debug,release ${{ startsWith(matrix.compiler, 'clang++-18') && 'address-sanitizer=norecover undefined-sanitizer=norecover' || '' }}
working-directory: ../boost-root/libs/regex/test
macos:
runs-on: macos-latest
strategy:
Expand Down Expand Up @@ -175,7 +228,7 @@ jobs:
run: ./config_info_travis
working-directory: ../boost-root/libs/config/test
- name: Test
run: ../../../b2 toolset=${{ matrix.toolset }} cxxstd=${{ matrix.standard }}
run: ../../../b2 variant=debug,release toolset=${{ matrix.toolset }} cxxstd=${{ matrix.standard }}
working-directory: ../boost-root/libs/regex/test
windows_gcc:
runs-on: windows-2019
Expand Down
12 changes: 8 additions & 4 deletions include/boost/regex/v5/basic_regex_creator.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -250,7 +250,7 @@ class basic_regex_creator
void fixup_pointers(re_syntax_base* state);
void fixup_recursions(re_syntax_base* state);
void create_startmaps(re_syntax_base* state);
int calculate_backstep(re_syntax_base* state);
int calculate_backstep(re_syntax_base* state, int recurse_count = 0);
void create_startmap(re_syntax_base* state, unsigned char* l_map, unsigned int* pnull, unsigned char mask, unsigned recursion_count = 0);
unsigned get_restart_type(re_syntax_base* state);
void set_all_masks(unsigned char* bits, unsigned char);
Expand Down Expand Up @@ -971,8 +971,12 @@ void basic_regex_creator<charT, traits>::create_startmaps(re_syntax_base* state)
}

template <class charT, class traits>
int basic_regex_creator<charT, traits>::calculate_backstep(re_syntax_base* state)
int basic_regex_creator<charT, traits>::calculate_backstep(re_syntax_base* state, int recurse_count)
{
if (recurse_count >= 2000) {
return -1;
}

typedef typename traits::char_class_type m_type;
int result = 0;
while(state)
Expand Down Expand Up @@ -1051,8 +1055,8 @@ int basic_regex_creator<charT, traits>::calculate_backstep(re_syntax_base* state
continue;
case syntax_element_alt:
{
int r1 = calculate_backstep(state->next.p);
int r2 = calculate_backstep(static_cast<re_alt*>(state)->alt.p);
int r1 = calculate_backstep(state->next.p, recurse_count + 1);
int r2 = calculate_backstep(static_cast<re_alt*>(state)->alt.p, recurse_count + 1);
if((r1 < 0) || (r1 != r2))
return -1;
return result + r1;
Expand Down
2 changes: 1 addition & 1 deletion include/boost/regex/v5/match_flags.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,7 @@ inline match_flags operator|(match_flags m1, match_flags m2)
inline match_flags operator^(match_flags m1, match_flags m2)
{ return static_cast<match_flags>(static_cast<std::int32_t>(m1) ^ static_cast<std::int32_t>(m2)); }
inline match_flags operator~(match_flags m1)
{ return static_cast<match_flags>(~static_cast<std::int32_t>(m1)); }
{ return static_cast<match_flags>(~static_cast<std::int32_t>(m1) & static_cast<std::int32_t>(match_not_any)); }
inline match_flags& operator&=(match_flags& m1, match_flags m2)
{ m1 = m1&m2; return m1; }
inline match_flags& operator|=(match_flags& m1, match_flags m2)
Expand Down
4 changes: 2 additions & 2 deletions include/boost/regex/v5/perl_matcher_non_recursive.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -237,8 +237,8 @@ void perl_matcher<BidiIterator, Allocator, traits>::extend_stack()
saved_state* backup_state;
stack_base = static_cast<saved_state*>(get_mem_block());
backup_state = reinterpret_cast<saved_state*>(reinterpret_cast<char*>(stack_base)+BOOST_REGEX_BLOCKSIZE);
saved_extra_block* block = static_cast<saved_extra_block*>(backup_state);
--block;
saved_extra_block* block = reinterpret_cast<saved_extra_block*>(
reinterpret_cast<std::uintptr_t>(backup_state) - sizeof(saved_extra_block));
(void) new (block) saved_extra_block(m_stack_base, m_backup_state);
m_stack_base = stack_base;
m_backup_state = block;
Expand Down
22 changes: 10 additions & 12 deletions test/de_fuzz/Jamfile.v2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,33 +5,31 @@

import testing ;

lib Fuzzer : : <search>. ;

run narrow.cpp [ glob ../../src/*.cpp ] Fuzzer
run narrow.cpp [ glob ../../src/*.cpp ]
: # additional args
-dict=dictionary.txt -workers=3 corpus -runs=5000
-dict=dictionary.txt -jobs=3 corpus -runs=5000
: # test-files
: # requirements
<toolset>clang <cxxflags>-fsanitize-coverage=trace-pc-guard
<cxxflags>-fsanitize=address <cxxflags>-fsanitize=undefined
<toolset>clang
<cxxflags>-fsanitize=fuzzer <cxxflags>-fsanitize=address <cxxflags>-fsanitize=undefined
<cxxflags>-fno-sanitize-recover=undefined <cxxflags>-fno-optimize-sibling-calls
<cxxflags>-fno-omit-frame-pointer
<include>../../../..
<linkflags>-fsanitize=address <linkflags>-fsanitize=undefined
<linkflags>-fsanitize=fuzzer <linkflags>-fsanitize=address <linkflags>-fsanitize=undefined
debug
;

run wide.cpp [ glob ../../src/*.cpp ] Fuzzer
run wide.cpp [ glob ../../src/*.cpp ]
: # additional args
-dict=dictionary.txt -workers=3 corpus -runs=5000
-dict=dictionary.txt -jobs=3 corpus -runs=5000
: # test-files
: # requirements
<toolset>clang <cxxflags>-fsanitize-coverage=trace-pc-guard
<cxxflags>-fsanitize=address <cxxflags>-fsanitize=undefined
<toolset>clang
<cxxflags>-fsanitize=fuzzer <cxxflags>-fsanitize=address <cxxflags>-fsanitize=undefined
<cxxflags>-fno-sanitize-recover=undefined <cxxflags>-fno-optimize-sibling-calls
<cxxflags>-fno-omit-frame-pointer
<include>../../../..
<linkflags>-fsanitize=address <linkflags>-fsanitize=undefined
<linkflags>-fsanitize=fuzzer <linkflags>-fsanitize=address <linkflags>-fsanitize=undefined
debug
;

Binary file added test/de_fuzz/corpus/corpus_1731
View file
Open in desktop
Binary file not shown.
Loading