From 973e3d01f08364fce4256f811dde999fc33de18f Mon Sep 17 00:00:00 2001 From: ganchuantao1 Date: Wed, 2 Apr 2025 15:56:34 +0800 Subject: [PATCH] =?UTF-8?q?=20=20=20=20abseil-cpp=20fix=20CVE-2025-0838=20?= =?UTF-8?q?,=E6=8C=91=E5=8D=955.0.3=20Signed-off-by:ganchuantao1"?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- backport-CVE-2025-0838.patch | 110 +++++++++++++++++++++++++++++++++++ install.sh | 1 + 2 files changed, 111 insertions(+) create mode 100644 backport-CVE-2025-0838.patch diff --git a/backport-CVE-2025-0838.patch b/backport-CVE-2025-0838.patch new file mode 100644 index 0000000..5332026 --- /dev/null +++ b/backport-CVE-2025-0838.patch @@ -0,0 +1,110 @@ +From 3c4b18dc14949d1c6dac8bae2e459c71b21e3416 Mon Sep 17 00:00:00 2001 +From: Derek Mauro +Date: Wed, 22 Jan 2025 15:58:56 -0500 +Subject: [PATCH] Fix potential integer overflow in hash container + create/resize + +The sized constructors, reserve(), and rehash() methods of +absl::{flat,node}_hash_{set,map} did not impose an upper bound on +their size argument. As a result, it was possible for a caller to pass +a very large size that would cause an integer overflow when computing +the size of the container's backing store. Subsequent accesses to the +container might then access out-of-bounds memory. + +The fix is in two parts: + +1) Update max_size() to return the maximum number of items that can be +stored in the container + +2) Validate the size arguments to the constructors, reserve(), and +rehash() methods, and abort the program when the argument is invalid + +We've looked at uses of these containers in Google codebases like +Chrome, and determined this vulnerability is likely to be difficult to +exploit. This is primarily because container sizes are rarely +attacker-controlled. + +The bug was discovered by Dmitry Vyukov . + +Conflict: remove absl/base/config.h and context adapt +Reference: https://github.com/abseil/abseil-cpp/commit/3c4b18dc14949d1c6dac8bae2e459c71b21e3416 +--- + absl/container/internal/raw_hash_set.h | 15 ++++++++++++++- + absl/container/internal/raw_hash_set_test.cc | 8 ++++++++ + 2 files changed, 22 insertions(+), 1 deletion(-) + +diff --git a/absl/container/internal/raw_hash_set.h b/absl/container/internal/raw_hash_set.h +index ea912f8..40c2c67 100644 +--- a/absl/container/internal/raw_hash_set.h ++++ b/absl/container/internal/raw_hash_set.h +@@ -745,6 +745,12 @@ inline size_t NormalizeCapacity(size_t n) { + return n ? ~size_t{} >> countl_zero(n) : 1; + } + ++template ++size_t MaxValidCapacity() { ++ return NormalizeCapacity((std::numeric_limits::max)() / 4 / ++ kSlotSize); ++} ++ + // General notes on capacity/growth methods below: + // - We use 7/8th as maximum load factor. For 16-wide groups, that gives an + // average of two empty slots per group. +@@ -1148,6 +1154,8 @@ class raw_hash_set { + : ctrl_(EmptyGroup()), + settings_(0, HashtablezInfoHandle(), hash, eq, alloc) { + if (bucket_count) { ++ ABSL_RAW_CHECK(bucket_count <= MaxValidCapacity(), ++ "Hash table size overflow"); + capacity_ = NormalizeCapacity(bucket_count); + initialize_slots(); + } +@@ -1341,7 +1349,9 @@ class raw_hash_set { + bool empty() const { return !size(); } + size_t size() const { return size_; } + size_t capacity() const { return capacity_; } +- size_t max_size() const { return (std::numeric_limits::max)(); } ++ size_t max_size() const { ++ return CapacityToGrowth(MaxValidCapacity()); ++ } + + ABSL_ATTRIBUTE_REINITIALIZES void clear() { + // Iterating over this container is O(bucket_count()). When bucket_count() +@@ -1678,6 +1688,8 @@ class raw_hash_set { + auto m = NormalizeCapacity(n | GrowthToLowerboundCapacity(size())); + // n == 0 unconditionally rehashes as per the standard. + if (n == 0 || m > capacity_) { ++ ABSL_RAW_CHECK(m <= MaxValidCapacity(), ++ "Hash table size overflow"); + resize(m); + + // This is after resize, to ensure that we have completed the allocation +@@ -1688,6 +1700,7 @@ class raw_hash_set { + + void reserve(size_t n) { + if (n > size() + growth_left()) { ++ ABSL_RAW_CHECK(n <= max_size(), "Hash table size overflow"); + size_t m = GrowthToLowerboundCapacity(n); + resize(NormalizeCapacity(m)); + +diff --git a/absl/container/internal/raw_hash_set_test.cc b/absl/container/internal/raw_hash_set_test.cc +index f77ffbc..078bbad 100644 +--- a/absl/container/internal/raw_hash_set_test.cc ++++ b/absl/container/internal/raw_hash_set_test.cc +@@ -2181,6 +2181,14 @@ TEST(Table, AlignOne) { + } + } + ++TEST(Table, MaxSizeOverflow) { ++ size_t overflow = (std::numeric_limits::max)(); ++ EXPECT_DEATH_IF_SUPPORTED(IntTable t(overflow), "Hash table size overflow"); ++ IntTable t; ++ EXPECT_DEATH_IF_SUPPORTED(t.reserve(overflow), "Hash table size overflow"); ++ EXPECT_DEATH_IF_SUPPORTED(t.rehash(overflow), "Hash table size overflow"); ++} ++ + } // namespace + } // namespace container_internal + ABSL_NAMESPACE_END +-- +2.43.0 \ No newline at end of file diff --git a/install.sh b/install.sh index d7f4a72..88d5f95 100755 --- a/install.sh +++ b/install.sh @@ -14,4 +14,5 @@ fi tar zxvf abseil-cpp-20220623.1.tar.gz mv abseil-cpp-20220623.1 abseil-cpp cd $1/abseil-cpp +patch -p1 < $1/backport-CVE-2025-0838.patch exit 0 \ No newline at end of file -- Gitee