Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[stable] std: Check for overflow in `str::repeat` #54397

Merged
merged 1 commit into from Sep 20, 2018

Conversation

Projects
None yet
4 participants
@alexcrichton
Copy link
Member

alexcrichton commented Sep 20, 2018

This commit fixes a buffer overflow issue in the standard library
discovered by Scott McMurray where if a large number was passed to
str::repeat it may cause and out of bounds write to the buffer of a Vec.
This bug was accidentally introduced in #48657 when optimizing the
str::repeat function. The bug affects stable Rust releases 1.26.0 to
1.29.0. We plan on backporting this fix to create a 1.29.1 release, and
the 1.30.0 release onwards will include this fix.

The fix in this commit is to introduce a deterministic panic in the case of
capacity overflow. When repeating a slice where the resulting length is larger
than the address space, there’s no way it can succeed anyway!

The standard library and surrounding libraries were briefly checked to see if
there were othere instances of preallocating a vector with a calculation that
may overflow. No instances of this bug (out of bounds write due to a calculation
overflow) were found at this time.

Note that this commit is the first steps towards fixing this issue,
we'll be making a formal post to the Rust security list once these
commits have been merged.

std: Check for overflow in `str::repeat`
This commit fixes a buffer overflow issue in the standard library
discovered by Scott McMurray where if a large number was passed to
`str::repeat` it may cause and out of bounds write to the buffer of a `Vec`.
This bug was accidentally introduced in #48657 when optimizing the
`str::repeat` function. The bug affects stable Rust releases 1.26.0 to
1.29.0. We plan on backporting this fix to create a 1.29.1 release, and
the 1.30.0 release onwards will include this fix.

The fix in this commit is to introduce a deterministic panic in the case of
capacity overflow. When repeating a slice where the resulting length is larger
than the address space, there’s no way it can succeed anyway!

The standard library and surrounding libraries were briefly checked to see if
there were othere instances of preallocating a vector with a calculation that
may overflow. No instances of this bug (out of bounds write due to a calculation
overflow) were found at this time.

Note that this commit is the first steps towards fixing this issue,
we'll be making a formal post to the Rust security list once these
commits have been merged.

@alexcrichton alexcrichton requested a review from Mark-Simulacrum Sep 20, 2018

@alexcrichton

This comment has been minimized.

Copy link
Member Author

alexcrichton commented Sep 20, 2018

This is accompanied with PRs to beta and master as well, and a reminder that a more formal announcement will be coming soon once we sort out these prs.

@bors: p=100

@alexcrichton

This comment has been minimized.

Copy link
Member Author

alexcrichton commented Sep 20, 2018

@steveklabnik

This comment has been minimized.

Copy link
Member

steveklabnik commented Sep 20, 2018

@bors: r+

@bors

This comment has been minimized.

Copy link
Contributor

bors commented Sep 20, 2018

📌 Commit 1b94b84 has been approved by steveklabnik

@bors

This comment has been minimized.

Copy link
Contributor

bors commented Sep 20, 2018

⌛️ Testing commit 1b94b84 with merge b801ae6...

bors added a commit that referenced this pull request Sep 20, 2018

Auto merge of #54397 - alexcrichton:fix-bug-stable, r=steveklabnik
[stable] std: Check for overflow in `str::repeat`

This commit fixes a buffer overflow issue in the standard library
discovered by Scott McMurray where if a large number was passed to
`str::repeat` it may cause and out of bounds write to the buffer of a `Vec`.
This bug was accidentally introduced in #48657 when optimizing the
`str::repeat` function. The bug affects stable Rust releases 1.26.0 to
1.29.0. We plan on backporting this fix to create a 1.29.1 release, and
the 1.30.0 release onwards will include this fix.

The fix in this commit is to introduce a deterministic panic in the case of
capacity overflow. When repeating a slice where the resulting length is larger
than the address space, there’s no way it can succeed anyway!

The standard library and surrounding libraries were briefly checked to see if
there were othere instances of preallocating a vector with a calculation that
may overflow. No instances of this bug (out of bounds write due to a calculation
overflow) were found at this time.

Note that this commit is the first steps towards fixing this issue,
we'll be making a formal post to the Rust security list once these
commits have been merged.
@bors

This comment has been minimized.

Copy link
Contributor

bors commented Sep 20, 2018

☀️ Test successful - status-appveyor, status-travis
Approved by: steveklabnik
Pushing b801ae6 to stable...

@bors bors merged commit 1b94b84 into rust-lang:stable Sep 20, 2018

2 checks passed

continuous-integration/travis-ci/pr The Travis CI build passed
Details
homu Test successful
Details

@alexcrichton alexcrichton deleted the alexcrichton:fix-bug-stable branch Sep 21, 2018

alexcrichton added a commit to alexcrichton/rust that referenced this pull request Sep 25, 2018

[beta] Add 1.29.1 release nodes
Forward-port of rust-lang#54397, should have included it earlier!

alexcrichton added a commit to alexcrichton/rust that referenced this pull request Sep 25, 2018

Add 1.29.1 release nodes
Forward-port of rust-lang#54397, should have included it earlier!

alexcrichton added a commit to alexcrichton/rust that referenced this pull request Sep 25, 2018

[beta] Add 1.29.1 release nodes
Forward-port of rust-lang#54397, should have included it earlier!

bors added a commit that referenced this pull request Sep 27, 2018

Auto merge of #54565 - alexcrichton:beta-next, r=nikomatsakis
[beta] Add 1.29.1 release nodes

Forward-port of #54397, should have included it earlier!

kennytm added a commit to kennytm/rust that referenced this pull request Sep 27, 2018

Rollup merge of rust-lang#54564 - alexcrichton:new-notes, r=kennytm
Add 1.29.1 release notes

Forward-port of rust-lang#54397, should have included it earlier!

kennytm added a commit to kennytm/rust that referenced this pull request Sep 29, 2018

Rollup merge of rust-lang#54564 - alexcrichton:new-notes, r=kennytm
Add 1.29.1 release notes

Forward-port of rust-lang#54397, should have included it earlier!
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.