openlink / virtuoso-opensource

Virtuoso is a high-performance and scalable Multi-Model RDBMS, Data Integration Middleware, Linked Data Deployment, and HTTP Application Server Platform
https://vos.openlinksw.com
Other
868 stars 210 forks source link

Virtuoso 7.2.12 stack overflows at `compile_regex` #1280

Open fuboat opened 6 months ago

fuboat commented 6 months ago

Virtuoso 7.2.12 stack overflows at compile_regex.

PoC:

SELECT REGEXP_LIKE('A', REPEAT('(?i)(?:', 100000));

Backtrace:

#0 0xf0e308 (compile_regex+0x18)
#1 0xf14745 (compile_branch+0x45b5)
#2 0xf0e573 (compile_regex+0x283)
#3 0xf14745 (compile_branch+0x45b5)
#4 0xf0e573 (compile_regex+0x283)
#5 0xf14745 (compile_branch+0x45b5)
#6 0xf0e573 (compile_regex+0x283)
#7 0xf14745 (compile_branch+0x45b5)
#8 0xf0e573 (compile_regex+0x283)
...
#1433 0xf14745 (compile_branch+0x45b5)
#1434 0xf0e573 (compile_regex+0x283)
#1435 0xf14745 (compile_branch+0x45b5)
#1436 0xf0e573 (compile_regex+0x283)
#1437 0xf0dc1d (virtpcre_compile2+0x82d)
#1438 0xc55acd (get_compiled_regexp+0xbd)
#1439 0xc56459 (bif_regexp_match+0x269)
#1440 0x755674 (ins_call_bif+0xc4)
#1441 0x763539 (code_vec_run_1+0xdf9)
#1442 0x7b9841 (qn_input+0x3c1)
#1443 0x7cda7a (qr_subq_exec+0x94a)
#1444 0x756631 (ins_call+0xc91)
#1445 0x758020 (ins_call_vec+0x320)
#1446 0x75b835 (code_vec_run_v+0xa25)
#1447 0x7b980f (qn_input+0x38f)
#1448 0x7b9cb6 (qn_send_output+0x236)
#1449 0x82c49d (set_ctr_vec_input+0x99d)
#1450 0x7b984e (qn_input+0x3ce)
#1451 0x7cb03b (qr_exec+0x11db)
#1452 0x7d89d6 (sf_sql_execute+0x11a6)
#1453 0x7d94de (sf_sql_execute_w+0x17e)
#1454 0x7e219d (sf_sql_execute_wrapper+0x3d)
#1455 0xe2aa3c (future_wrapper+0x3fc)
#1456 0xe3233e (_thread_boot+0x11e)
#1457 0x7fd5cc227609 (start_thread+0xd9)
#1458 0x7fd5cbff7353 (clone+0x43)
pkleef commented 6 months ago

This is actually a problem with the version of the PCRE v7.9 library we are using which does not have settings for checking recursion depth in compile_regex.

We are currently evaluation to see if we can move to either PCRE v8.45 library or how much work it is to migrate our code to the much newer PCRE2 v10.39 library.

I will report our decision in this issue.