@matheusbsbs / matheus-bagliano / commits / a25b908504

grep: fix segfault under -P + PCRE2 <=10.30 + (*NO_JIT)

Fix a bug in the compilation of PCRE2 patterns under JIT (the most common runtime configuration). Any pattern with a (*NO_JIT) verb would segfault in any currently released PCRE2 version: $ git grep -P '(*NO_JIT)hi.*there' Segmentation fault That this segfaulted was a bug in PCRE2 itself, after reporting it[1] on pcre-dev it's been fixed in a yet-to-be-released version of PCRE (presumably released first as 10.31). Now it'll die with: $ git grep -P '(*NO_JIT)hi.*there' fatal: pcre2_jit_match failed with error code -45: bad JIT option But the cause of the bug is in our own code dating back to my 94da9193a6 ("grep: add support for PCRE v2", 2017-06-01). As explained at more length in the comment being added here, it isn't sufficient to just check pcre2_config() to see whether the JIT should be used, pcre2_pattern_info() also has to be asked. This is something I discovered myself when fiddling around with PCRE2 verbs in patterns passed to git. I don't expect that any user of git has encountered this given the obscurity of passing PCRE2 verbs through to the library, along with the relative obscurity of (*NO_JIT) itself. 1. "How am I supposed to use PCRE2 JIT in the face of (*NO_JIT) ?" (<CACBZZX5mMqDuWuFmi7sRBp3wH6CFyd-ghACukd=v0NN=rBMnJg@mail.gmail.com> & https://lists.exim.org/lurker/thread/20171123.101502.7f0d38ca.en.html) on the pcre-dev mailing list Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Ævar Arnfjörð Bjarmason committed Nov 23, 2017 at 14:16 UTC a25b9085043b8029169b4d5b172b78ca3f38fb37

2 files changed +32

grep.c

+26

@@ -477,6 +477,8 @@ static void compile_pcre2_pattern(struct grep_pat *p, const struct grep_opt *opt

477 int options = PCRE2_MULTILINE;

478 const uint8_t *character_tables = NULL;

479 int jitret;

480 + int patinforet;

481 + size_t jitsizearg;

482

483 assert(opt->pcre2);

484

@@ -511,6 +513,30 @@ static void compile_pcre2_pattern(struct grep_pat *p, const struct grep_opt *opt

513 jitret = pcre2_jit_compile(p->pcre2_pattern, PCRE2_JIT_COMPLETE);

514 if (jitret)

515 die("Couldn't JIT the PCRE2 pattern '%s', got '%d'\n", p->pattern, jitret);

516 +

517 + /*

518 + * The pcre2_config(PCRE2_CONFIG_JIT, ...) call just

519 + * tells us whether the library itself supports JIT,

520 + * but to see whether we're going to be actually using

521 + * JIT we need to extract PCRE2_INFO_JITSIZE from the

522 + * pattern *after* we do pcre2_jit_compile() above.

523 + *

524 + * This is because if the pattern contains the

525 + * (*NO_JIT) verb (see pcre2syntax(3))

526 + * pcre2_jit_compile() will exit early with 0. If we

527 + * then proceed to call pcre2_jit_match() further down

528 + * the line instead of pcre2_match() we'll either

529 + * segfault (pre PCRE 10.31) or run into a fatal error

530 + * (post PCRE2 10.31)

531 + */

532 + patinforet = pcre2_pattern_info(p->pcre2_pattern, PCRE2_INFO_JITSIZE, &jitsizearg);

533 + if (patinforet)

534 + BUG("pcre2_pattern_info() failed: %d", patinforet);

535 + if (jitsizearg == 0) {

536 + p->pcre2_jit_on = 0;

537 + return;

538 + }

539 +

540 p->pcre2_jit_stack = pcre2_jit_stack_create(1, 1024 * 1024, NULL);

541 if (!p->pcre2_jit_stack)

542 die("Couldn't allocate PCRE2 JIT stack");

t/t7810-grep.sh

@@ -1110,6 +1110,12 @@ test_expect_success PCRE 'grep -P pattern' '

1110 test_cmp expected actual

1111 '

1112

1113 +test_expect_success LIBPCRE2 "grep -P with (*NO_JIT) doesn't error out" '

1114 + git grep -P "(*NO_JIT)\p{Ps}.*?\p{Pe}" hello.c >actual &&

1115 + test_cmp expected actual

1116 +

1117 +'

1118 +

1119 test_expect_success !PCRE 'grep -P pattern errors without PCRE' '

1120 test_must_fail git grep -P "foo.*bar"

1121 '