File CVE-2025-0838.patch of Package abseil-cpp.42328
From d605806bc50f538118ed044b39f084a3295c4ec2 Mon Sep 17 00:00:00 2001
From: Derek Mauro <761129+derekmauro@users.noreply.github.com>
Date: Thu, 23 Jan 2025 09:51:22 -0500
Subject: [PATCH 2/2] Fix potential integer overflow in hash container
create/resize (#1812)
The sized constructors, reserve(), and rehash() methods of
absl::{flat,node}_hash_{set,map} did not impose an upper bound on
their size argument. As a result, it was possible for a caller to pass
a very large size that would cause an integer overflow when computing
the size of the container's backing store. Subsequent accesses to the
container might then access out-of-bounds memory.
The fix is in two parts:
1) Update max_size() to return the maximum number of items that can be
stored in the container
2) Validate the size arguments to the constructors, reserve(), and
rehash() methods, and abort the program when the argument is invalid
We've looked at uses of these containers in Google codebases like
Chrome, and determined this vulnerability is likely to be difficult to
exploit. This is primarily because container sizes are rarely
attacker-controlled.
The bug was discovered by Dmitry Vyukov <dvyukov@google.com>.
---
absl/container/internal/raw_hash_set.h | 15 +-
absl/container/internal/raw_hash_set_test.cc | 244 +++++++++++++++++++
2 files changed, 258 insertions(+), 1 deletion(-)
diff --git a/absl/container/internal/raw_hash_set.h b/absl/container/internal/raw_hash_set.h
index 12682b35..2f23a7b7 100644
--- a/absl/container/internal/raw_hash_set.h
+++ b/absl/container/internal/raw_hash_set.h
@@ -487,6 +487,12 @@ inline size_t NormalizeCapacity(size_t n) {
return n ? ~size_t{} >> countl_zero(n) : 1;
}
+template <size_t kSlotSize>
+size_t MaxValidCapacity() {
+ return NormalizeCapacity((std::numeric_limits<size_t>::max)() / 4 /
+ kSlotSize);
+}
+
// General notes on capacity/growth methods below:
// - We use 7/8th as maximum load factor. For 16-wide groups, that gives an
// average of two empty slots per group.
@@ -875,6 +881,8 @@ class raw_hash_set {
: ctrl_(EmptyGroup()),
settings_(0, HashtablezInfoHandle(), hash, eq, alloc) {
if (bucket_count) {
+ ABSL_RAW_CHECK(bucket_count <= MaxValidCapacity<sizeof(slot_type)>(),
+ "Hash table size overflow");
capacity_ = NormalizeCapacity(bucket_count);
initialize_slots();
}
@@ -1068,7 +1076,9 @@ class raw_hash_set {
bool empty() const { return !size(); }
size_t size() const { return size_; }
size_t capacity() const { return capacity_; }
- size_t max_size() const { return (std::numeric_limits<size_t>::max)(); }
+ size_t max_size() const {
+ return CapacityToGrowth(MaxValidCapacity<sizeof(slot_type)>());
+ }
ABSL_ATTRIBUTE_REINITIALIZES void clear() {
// Iterating over this container is O(bucket_count()). When bucket_count()
@@ -1404,6 +1414,8 @@ class raw_hash_set {
auto m = NormalizeCapacity(n | GrowthToLowerboundCapacity(size()));
// n == 0 unconditionally rehashes as per the standard.
if (n == 0 || m > capacity_) {
+ ABSL_RAW_CHECK(m <= MaxValidCapacity<sizeof(slot_type)>(),
+ "Hash table size overflow");
resize(m);
// This is after resize, to ensure that we have completed the allocation
@@ -1414,6 +1426,7 @@ class raw_hash_set {
void reserve(size_t n) {
if (n > size() + growth_left()) {
+ ABSL_RAW_CHECK(n <= max_size(), "Hash table size overflow");
size_t m = GrowthToLowerboundCapacity(n);
resize(NormalizeCapacity(m));
diff --git a/absl/container/internal/raw_hash_set_test.cc b/absl/container/internal/raw_hash_set_test.cc
index 362b3cae..1f1644b6 100644
--- a/absl/container/internal/raw_hash_set_test.cc
+++ b/absl/container/internal/raw_hash_set_test.cc
@@ -2174,6 +2174,250 @@ TEST(Table, AlignOne) {
}
}
+TEST(Iterator, InvalidUseCrashesWithSanitizers) {
+ if (!SwisstableGenerationsEnabled()) GTEST_SKIP() << "Generations disabled.";
+ if (kMsvc) GTEST_SKIP() << "MSVC doesn't support | in regexp.";
+
+ IntTable t;
+ // Start with 1 element so that `it` is never an end iterator.
+ t.insert(-1);
+ for (int i = 0; i < 10; ++i) {
+ auto it = t.begin();
+ t.insert(i);
+ EXPECT_DEATH_IF_SUPPORTED(*it, kInvalidIteratorDeathMessage);
+ EXPECT_DEATH_IF_SUPPORTED(void(it == t.begin()),
+ kInvalidIteratorDeathMessage);
+ }
+}
+
+TEST(Iterator, InvalidUseWithReserveCrashesWithSanitizers) {
+ if (!SwisstableGenerationsEnabled()) GTEST_SKIP() << "Generations disabled.";
+ if (kMsvc) GTEST_SKIP() << "MSVC doesn't support | in regexp.";
+
+ IntTable t;
+ t.reserve(10);
+ t.insert(0);
+ auto it = t.begin();
+ // Reserved growth can't rehash.
+ for (int i = 1; i < 10; ++i) {
+ t.insert(i);
+ EXPECT_EQ(*it, 0);
+ }
+ // ptr will become invalidated on rehash.
+ const int64_t* ptr = &*it;
+ (void)ptr;
+
+ // erase decreases size but does not decrease reserved growth so the next
+ // insertion still invalidates iterators.
+ t.erase(0);
+ // The first insert after reserved growth is 0 is guaranteed to rehash when
+ // generations are enabled.
+ t.insert(10);
+ EXPECT_DEATH_IF_SUPPORTED(*it, kInvalidIteratorDeathMessage);
+ EXPECT_DEATH_IF_SUPPORTED(void(it == t.begin()),
+ kInvalidIteratorDeathMessage);
+#ifdef ABSL_HAVE_ADDRESS_SANITIZER
+ EXPECT_DEATH_IF_SUPPORTED(std::cout << *ptr, "heap-use-after-free");
+#endif
+}
+
+TEST(Iterator, InvalidUseWithMoveCrashesWithSanitizers) {
+ if (!SwisstableGenerationsEnabled()) GTEST_SKIP() << "Generations disabled.";
+ if (kMsvc) GTEST_SKIP() << "MSVC doesn't support | in regexp.";
+
+ IntTable t1, t2;
+ t1.insert(1);
+ auto it = t1.begin();
+ // ptr will become invalidated on rehash.
+ const int64_t* ptr = &*it;
+ (void)ptr;
+
+ t2 = std::move(t1);
+ EXPECT_DEATH_IF_SUPPORTED(*it, kInvalidIteratorDeathMessage);
+ EXPECT_DEATH_IF_SUPPORTED(void(it == t2.begin()),
+ kInvalidIteratorDeathMessage);
+#ifdef ABSL_HAVE_ADDRESS_SANITIZER
+ EXPECT_DEATH_IF_SUPPORTED(std::cout << *ptr, "heap-use-after-free");
+#endif
+}
+
+TEST(Table, ReservedGrowthUpdatesWhenTableDoesntGrow) {
+ IntTable t;
+ for (int i = 0; i < 8; ++i) t.insert(i);
+ // Want to insert twice without invalidating iterators so reserve.
+ const size_t cap = t.capacity();
+ t.reserve(t.size() + 2);
+ // We want to be testing the case in which the reserve doesn't grow the table.
+ ASSERT_EQ(cap, t.capacity());
+ auto it = t.find(0);
+ t.insert(100);
+ t.insert(200);
+ // `it` shouldn't have been invalidated.
+ EXPECT_EQ(*it, 0);
+}
+
+TEST(Table, EraseBeginEndResetsReservedGrowth) {
+ bool frozen = false;
+ BadHashFreezableIntTable t{FreezableAlloc<int64_t>(&frozen)};
+ t.reserve(100);
+ const size_t cap = t.capacity();
+ frozen = true; // no further allocs allowed
+
+ for (int i = 0; i < 10; ++i) {
+ // Create a long run (hash function returns constant).
+ for (int j = 0; j < 100; ++j) t.insert(j);
+ // Erase elements from the middle of the long run, which creates tombstones.
+ for (int j = 30; j < 60; ++j) t.erase(j);
+ EXPECT_EQ(t.size(), 70);
+ EXPECT_EQ(t.capacity(), cap);
+ ASSERT_EQ(RawHashSetTestOnlyAccess::CountTombstones(t), 30);
+
+ t.erase(t.begin(), t.end());
+
+ EXPECT_EQ(t.size(), 0);
+ EXPECT_EQ(t.capacity(), cap);
+ ASSERT_EQ(RawHashSetTestOnlyAccess::CountTombstones(t), 0);
+ }
+}
+
+TEST(Table, GenerationInfoResetsOnClear) {
+ if (!SwisstableGenerationsEnabled()) GTEST_SKIP() << "Generations disabled.";
+ if (kMsvc) GTEST_SKIP() << "MSVC doesn't support | in regexp.";
+
+ IntTable t;
+ for (int i = 0; i < 1000; ++i) t.insert(i);
+ t.reserve(t.size() + 100);
+
+ t.clear();
+
+ t.insert(0);
+ auto it = t.begin();
+ t.insert(1);
+ EXPECT_DEATH_IF_SUPPORTED(*it, kInvalidIteratorDeathMessage);
+}
+
+TEST(Table, InvalidReferenceUseCrashesWithSanitizers) {
+ if (!SwisstableGenerationsEnabled()) GTEST_SKIP() << "Generations disabled.";
+#ifdef ABSL_HAVE_MEMORY_SANITIZER
+ GTEST_SKIP() << "MSan fails to detect some of these rehashes.";
+#endif
+
+ IntTable t;
+ t.insert(0);
+ // Rehashing is guaranteed on every insertion while capacity is less than
+ // RehashProbabilityConstant().
+ int64_t i = 0;
+ while (t.capacity() <= RehashProbabilityConstant()) {
+ // ptr will become invalidated on rehash.
+ const int64_t* ptr = &*t.begin();
+ t.insert(++i);
+ EXPECT_DEATH_IF_SUPPORTED(std::cout << *ptr, "use-after-free") << i;
+ }
+}
+
+TEST(Iterator, InvalidComparisonDifferentTables) {
+ if (!SwisstableGenerationsEnabled()) GTEST_SKIP() << "Generations disabled.";
+
+ IntTable t1, t2;
+ IntTable::iterator default_constructed_iter;
+ // We randomly use one of N empty generations for generations from empty
+ // hashtables. In general, we won't always detect when iterators from
+ // different empty hashtables are compared, but in this test case, we
+ // should deterministically detect the error due to our randomness yielding
+ // consecutive random generations.
+ EXPECT_DEATH_IF_SUPPORTED(void(t1.end() == t2.end()),
+ "Invalid iterator comparison.*empty hashtables");
+ EXPECT_DEATH_IF_SUPPORTED(void(t1.end() == default_constructed_iter),
+ "Invalid iterator comparison.*default-constructed");
+ t1.insert(0);
+ EXPECT_DEATH_IF_SUPPORTED(void(t1.begin() == t2.end()),
+ "Invalid iterator comparison.*empty hashtable");
+ EXPECT_DEATH_IF_SUPPORTED(void(t1.begin() == default_constructed_iter),
+ "Invalid iterator comparison.*default-constructed");
+ t2.insert(0);
+ EXPECT_DEATH_IF_SUPPORTED(void(t1.begin() == t2.end()),
+ "Invalid iterator comparison.*end.. iterator");
+ EXPECT_DEATH_IF_SUPPORTED(void(t1.begin() == t2.begin()),
+ "Invalid iterator comparison.*non-end");
+}
+
+template <typename Alloc>
+using RawHashSetAlloc = raw_hash_set<IntPolicy, hash_default_hash<int64_t>,
+ std::equal_to<int64_t>, Alloc>;
+
+TEST(Table, AllocatorPropagation) { TestAllocPropagation<RawHashSetAlloc>(); }
+
+struct CountedHash {
+ size_t operator()(int value) const {
+ ++count;
+ return static_cast<size_t>(value);
+ }
+ mutable int count = 0;
+};
+
+struct CountedHashIntTable
+ : raw_hash_set<IntPolicy, CountedHash, std::equal_to<int>,
+ std::allocator<int>> {
+ using Base = typename CountedHashIntTable::raw_hash_set;
+ using Base::Base;
+};
+
+TEST(Table, CountedHash) {
+ // Verify that raw_hash_set does not compute redundant hashes.
+#ifdef NDEBUG
+ constexpr bool kExpectMinimumHashes = true;
+#else
+ constexpr bool kExpectMinimumHashes = false;
+#endif
+ if (!kExpectMinimumHashes) {
+ GTEST_SKIP() << "Only run under NDEBUG: `assert` statements may cause "
+ "redundant hashing.";
+ }
+
+ using Table = CountedHashIntTable;
+ auto HashCount = [](const Table& t) { return t.hash_function().count; };
+ {
+ Table t;
+ EXPECT_EQ(HashCount(t), 0);
+ }
+ {
+ Table t;
+ t.insert(1);
+ EXPECT_EQ(HashCount(t), 1);
+ t.erase(1);
+ EXPECT_EQ(HashCount(t), 2);
+ }
+ {
+ Table t;
+ t.insert(3);
+ EXPECT_EQ(HashCount(t), 1);
+ auto node = t.extract(3);
+ EXPECT_EQ(HashCount(t), 2);
+ t.insert(std::move(node));
+ EXPECT_EQ(HashCount(t), 3);
+ }
+ {
+ Table t;
+ t.emplace(5);
+ EXPECT_EQ(HashCount(t), 1);
+ }
+ {
+ Table src;
+ src.insert(7);
+ Table dst;
+ dst.merge(src);
+ EXPECT_EQ(HashCount(dst), 1);
+ }
+}
+
+TEST(Table, MaxSizeOverflow) {
+ size_t overflow = (std::numeric_limits<size_t>::max)();
+ EXPECT_DEATH_IF_SUPPORTED(IntTable t(overflow), "Hash table size overflow");
+ IntTable t;
+ EXPECT_DEATH_IF_SUPPORTED(t.reserve(overflow), "Hash table size overflow");
+ EXPECT_DEATH_IF_SUPPORTED(t.rehash(overflow), "Hash table size overflow");
+}
+
} // namespace
} // namespace container_internal
ABSL_NAMESPACE_END
--
2.52.0
