-
Notifications
You must be signed in to change notification settings - Fork 183
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Probable thread-safety issue in pcre2 10.43+ #402
Comments
Just the other day I was also wondering why the unlock mas moved before the end of the function. It just felt wrong. @carenas do you remember? zherczeg/sljit@7de0fee#diff-249fa9ceb0eb2b074dbaa38dfca020158e15e36e8a7b5d0aca1443226bf4b63aR243 |
It was likely unintentional and therefore a bug |
https://bugs.kde.org/show_bug.cgi?id=484514 has a similar backtrace |
Up to you. Let me know your decision. |
The locked section needs to extend until we are done modifying internal block offsets and sizes, otherwise we risk running into data corruption in a multi-threaded context. This bug was introduced in 7de0fee See: PCRE2Project/pcre2#402
An erroneous locking issue was introduced in the sljit update of commit d84f255. It caused crashes when matching regular expressions in a multi-threaded context. Fixes PCRE2Project#402
@zherczeg thanks for the very quick merge :) |
Fix is now in the master branch e466d41, thank you! |
Hi! Do you think this warrants a release, given the bug causes crashes? |
Probably fairly soon, but I am currently chasing down an obscure bug that oss-fuzz found and it would be nice to have that cleared up as well. |
Our application is matching elements against patterns in several concurrent threads and we had some crash reports from users who updated to recent pcre2: davatorium/rofi#1966.
After a collective effort, we tracked down a probable culprit as a regression introduced in d84f255, in particular the locking logic in the jit allocator.
From an educated guess, the fix could be to protect (again) some fields access in next_header, as these are also read in the free() function:
It stopped crashing after this change for at least one of the testers.
CC: @christian-heusel, @DaveDavenport, @ravomavain, @dennisschagt
The text was updated successfully, but these errors were encountered: