{"id":2232538,"url":"http://patchwork.ozlabs.org/api/1.1/patches/2232538/?format=json","web_url":"http://patchwork.ozlabs.org/project/glibc/patch/20260504172206.2470310-1-avinal.xlvii@gmail.com/","project":{"id":41,"url":"http://patchwork.ozlabs.org/api/1.1/projects/41/?format=json","name":"GNU C Library","link_name":"glibc","list_id":"libc-alpha.sourceware.org","list_email":"libc-alpha@sourceware.org","web_url":"","scm_url":"","webscm_url":""},"msgid":"<20260504172206.2470310-1-avinal.xlvii@gmail.com>","date":"2026-05-04T17:22:05","name":"[v3,1/2] intl: Import plural expression hardening from GNU gettext","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"163fa8dfe860eb34f8d97497da7e194801f8581d","submitter":{"id":88549,"url":"http://patchwork.ozlabs.org/api/1.1/people/88549/?format=json","name":"Avinal Kumar","email":"avinal.xlvii@gmail.com"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/glibc/patch/20260504172206.2470310-1-avinal.xlvii@gmail.com/mbox/","series":[{"id":502702,"url":"http://patchwork.ozlabs.org/api/1.1/series/502702/?format=json","web_url":"http://patchwork.ozlabs.org/project/glibc/list/?series=502702","date":"2026-05-04T17:22:05","name":"[v3,1/2] intl: Import plural expression hardening from GNU gettext","version":3,"mbox":"http://patchwork.ozlabs.org/series/502702/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2232538/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2232538/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","libc-alpha@sourceware.org"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","libc-alpha@sourceware.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256\n header.s=20251104 header.b=dgPNuhFt;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org\n (client-ip=2620:52:6:3111::32; helo=vm01.sourceware.org;\n envelope-from=libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org;\n receiver=patchwork.ozlabs.org)","sourceware.org;\n\tdkim=pass (2048-bit key,\n unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256\n header.s=20251104 header.b=dgPNuhFt","sourceware.org;\n dmarc=pass (p=none dis=none) header.from=gmail.com","sourceware.org; spf=pass smtp.mailfrom=gmail.com","server2.sourceware.org;\n arc=none smtp.remote-ip=2607:f8b0:4864:20::631"],"Received":["from vm01.sourceware.org (vm01.sourceware.org\n [IPv6:2620:52:6:3111::32])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g8T493vKwz1yJV\n\tfor ; Tue, 05 May 2026 03:22:49 +1000 (AEST)","from vm01.sourceware.org (localhost [127.0.0.1])\n\tby sourceware.org (Postfix) with ESMTP id B09504B9DB70\n\tfor ; Mon, 4 May 2026 17:22:47 +0000 (GMT)","from mail-pl1-x631.google.com (mail-pl1-x631.google.com\n [IPv6:2607:f8b0:4864:20::631])\n by sourceware.org (Postfix) with ESMTPS id C36CF4BABF1E\n for ; Mon, 4 May 2026 17:22:25 +0000 (GMT)","by mail-pl1-x631.google.com with SMTP id\n d9443c01a7336-2ad4d639db3so19087475ad.0\n for ; Mon, 04 May 2026 10:22:25 -0700 (PDT)","from fedoraemon.neon-universe.ts.net\n ([2406:7400:11d:a9dc:9a14:72eb:1a60:868a])\n by smtp.gmail.com with ESMTPSA id\n d9443c01a7336-2b9cae36885sm114138955ad.59.2026.05.04.10.22.20\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Mon, 04 May 2026 10:22:21 -0700 (PDT)"],"DKIM-Filter":["OpenDKIM Filter v2.11.0 sourceware.org B09504B9DB70","OpenDKIM Filter v2.11.0 sourceware.org C36CF4BABF1E"],"DMARC-Filter":"OpenDMARC Filter v1.4.2 sourceware.org C36CF4BABF1E","ARC-Filter":"OpenARC Filter v1.0.0 sourceware.org C36CF4BABF1E","ARC-Seal":"i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1777915346; cv=none;\n b=GKcSLHiw7BQn7WvOUQjYwgOEq4ROwKGURYQFC4XzeOjTtRhvwtRoR23lVnb8PqEQjeytJD/fd3gG0aVwM8ZMIXEAVTL78w2oWW5LO1A4p9nk7rkOAtxH+6D4NLYXXz9XmlLtuG4i8gVyiN+EikJ8t2PBzT3sSmCgrhU9JCrCrXo=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=sourceware.org; s=key;\n t=1777915346; c=relaxed/simple;\n bh=i5MFIiyVx+yPv9uYr/G8lG5MGbDLeqfY2DdMCcJE84s=;\n h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version;\n b=ectBlRYGezWy6XK5qp/ovx14ptq8V2SOI7We8EqaZyA83cR4FTsIyfVovK4nDB4VN6pujk6OhVYCwvOMXXRWOl+NvfRsWaW5DV+6QqqTOl3HcjmJUYsI1zMIP9BNgtH8doddS9IgJdwCKZAlWA1bNp2onDB+E2YpBoNp6EOTux4=","ARC-Authentication-Results":"i=1; server2.sourceware.org","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=gmail.com; s=20251104; t=1777915343; x=1778520143; darn=sourceware.org;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:from:to:cc:subject:date:message-id:reply-to;\n bh=2p51vpgWBfWUG2GjgTRVZuC9j/V9xqNnYRDLRBM2YKw=;\n b=dgPNuhFtBNK1cF3UVOob5fpKXdJmVgiQn31l9i41Gz2vdvSl2DAEL46CRb6tQIvw3u\n DOcikjlS/8arE02Jcu87pxAVZluIWIMtUriZ5asIlyD1PsZlOhs7DF1SnN+PuqlZSSl4\n 3L86iCcOq14bTfhR+GHnOVY/L+iP8/ggOZRMW8hUoJbpit29NHEwi92KV4SIe6MA4vKh\n xT/RnXbK3IlIwlqYkJ6rNnAjkV7HyEfCP10uU/pMstDZIrXm9z4kyfK6ttfTgranU/BF\n to31ge4/lr5YKvLgeCB3Dp+gn8+jMUvmq17OtBWD7PbWWlmZuIqLf8m95RmQyVI/YiL5\n SfJQ==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1777915343; x=1778520143;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date\n :message-id:reply-to;\n bh=2p51vpgWBfWUG2GjgTRVZuC9j/V9xqNnYRDLRBM2YKw=;\n b=g9KeS/Q7MOyeQ/Qyf1/0XCKzajg5PIz+/WDXAZlwNyie34UxGQQTyGYLfDO4eM7qGE\n wFj3LHXS9dZhrLG4jZUXkIgpzH1fv8yk5Dm9lqpV/sn+JYnBV+cVOJV1Lw3MqqgkWRny\n fHhaLBh9AVGkV7kRkqSVFqQbw+8UVH8NnrF0mt/57b/8DQs2sO9/GqbjDAoYmFIG0lWb\n wDIl/HSF4UB0TqQZvwffhRXB7ijBipqjpoY6DiI/9GViEIXuGaQFGv5+HJC+sPk5IE3H\n t8frNbMw7qzDNNdXPkXpAI5SGH94cg91mJWIDRffhruYVFKvtpjJUtDQH2A5FnaQKgBh\n 6ocA==","X-Gm-Message-State":"AOJu0YwDQVY8+tPswUASGBxG8BJMIAxE6OqtSOZICCc2TdPkJDQZD71U\n UhO58t2Xy6prnouDTlrOVdJmp9WyZogD2u0+K9F3nDnkSChPv9zci3BM5a1MYg==","X-Gm-Gg":"AeBDiesSVliKWxUPzJkBFWfyCBZAlWW4xX3/LwURWi1ZBwSPlcXnALs0JujQQ6Nby1h\n QNq9OEeeeXPavKzyrqH7J0fj0MeEPTsFeNlKnipSw3HjyxUDBwWTI6J1vhVLVESLMB5OxZ/TTe1\n a3rZvfG7IsdgRariawothmfX8o9ammsMH7QqOQdJaEKaTclbRr3e5hYqurPYY7NnyIa5FFizsj+\n Ul4wTlR5BlpId6U+48UstIu6HLSNQQQmoGv3OIQxKm/0k5Vh/pVeA3olawz15KmixTw+KuCiBDu\n zp1TMli0+8XSOSXBPvLcJJIiA440Ux1Y11Jwa2zP2gHnawxctFTmv3adh2mp8Qb5qGocyvu2VVe\n GqEl0U3RQg2GNsTHkWYpi1fCTyRj+RkQpDbIjN4mjt0Wl1/8/H6KWXr5/7cqdwPbCX1/Ev6qXfs\n T5+NKljkO607fJ+qtjucSNhjfz6Y2F72cf4S+zalxyzw73X+ZGKOLxiPlgyJb1zm4lIef0+2S9+\n Z2a","X-Received":"by 2002:a17:902:cf4c:b0:2ba:307:4577 with SMTP id\n d9443c01a7336-2ba03074751mr80525065ad.2.1777915343052;\n Mon, 04 May 2026 10:22:23 -0700 (PDT)","From":"Avinal Kumar ","To":"libc-alpha@sourceware.org","Cc":"adhemerval.zanella@linaro.org","Subject":"[PATCH v3 1/2] intl: Import plural expression hardening from GNU\n gettext","Date":"Mon, 4 May 2026 22:52:05 +0530","Message-ID":"<20260504172206.2470310-1-avinal.xlvii@gmail.com>","X-Mailer":"git-send-email 2.54.0","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit","X-BeenThere":"libc-alpha@sourceware.org","X-Mailman-Version":"2.1.30","Precedence":"list","List-Id":"Libc-alpha mailing list ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org"},"content":"The plural expression evaluator plural_eval() in eval-plural.h uses\nunbounded recursion, which can cause a stack overflow crash with\ndeeply nested expressions in malicious .mo files. This is\nparticularly dangerous on threads with small stacks (musl libc\ndefault: 128 KB, AIX 7 default: 96 KB, glibc after ulimit -s 260:\n~3919 recursions max).\n\nAdditionally, division by zero in plural expressions triggers\nraise(SIGFPE), which is not multithread-safe, catching SIGFPE\nrequires per-process signal handlers that race with other threads.\n\nFix both by importing the hardening from GNU gettext:\n\n- Replace unbounded plural_eval() with depth-limited\n plural_eval_recurse() (EVAL_MAXDEPTH=100), returning a\n struct eval_result with status instead of a bare unsigned long.\n\n- Return PE_INTDIV status on division by zero instead of raising\n SIGFPE. Remove the architecture-specific INTDIV0_RAISES_SIGFPE\n macro and the conditional #include .\n\n- Update plural_lookup() in dcigettext.c to handle the new return\n type, falling back to index 0 on any evaluation failure.\n\nBased on GNU gettext commits ef37a1540 and 726bfb1d1.\nDiscussed on: https://sourceware.org/pipermail/libc-alpha/2023-October/152010.html\n\nOriginal author: Bruno Haible \nSigned-off-by: Avinal Kumar \nReviewed-by: Adhemerval Zanella \n---\n intl/dcigettext.c | 27 +++------\n intl/eval-plural.h | 139 ++++++++++++++++++++++++++++++++++-----------\n intl/plural-exp.h | 21 ++++++-\n 3 files changed, 134 insertions(+), 53 deletions(-)","diff":"diff --git a/intl/dcigettext.c b/intl/dcigettext.c\nindex 9ebc54eeec..fb948c1092 100644\n--- a/intl/dcigettext.c\n+++ b/intl/dcigettext.c\n@@ -68,20 +68,6 @@ extern int errno;\n \n #include \n \n-#ifdef _LIBC\n- /* Guess whether integer division by zero raises signal SIGFPE.\n- Set to 1 only if you know for sure. In case of doubt, set to 0. */\n-# if defined __alpha__ || defined __arm__ || defined __i386__ \\\n- || defined __m68k__ || defined __s390x__\n-# define INTDIV0_RAISES_SIGFPE 1\n-# else\n-# define INTDIV0_RAISES_SIGFPE 0\n-# endif\n-#endif\n-#if !INTDIV0_RAISES_SIGFPE\n-# include \n-#endif\n-\n #if defined HAVE_SYS_PARAM_H || defined _LIBC\n # include \n #endif\n@@ -1381,14 +1367,19 @@ plural_lookup (struct loaded_l10nfile *domain, unsigned long int n,\n \t const char *translation, size_t translation_len)\n {\n struct loaded_domain *domaindata = (struct loaded_domain *) domain->data;\n+ struct eval_result result;\n unsigned long int index;\n const char *p;\n \n- index = plural_eval (domaindata->plural, n);\n- if (index >= domaindata->nplurals)\n- /* This should never happen. It means the plural expression and the\n- given maximum value do not match. */\n+ result = plural_eval (domaindata->plural, n);\n+ if (result.status != PE_OK)\n+ /* The plural expression evaluation failed. */\n index = 0;\n+ else if (result.value >= domaindata->nplurals)\n+ /* The plural expression and the given maximum value do not match. */\n+ index = 0;\n+ else\n+ index = result.value;\n \n /* Skip INDEX strings at TRANSLATION. */\n p = translation;\ndiff --git a/intl/eval-plural.h b/intl/eval-plural.h\nindex 243f6027a1..e231e9bfd3 100644\n--- a/intl/eval-plural.h\n+++ b/intl/eval-plural.h\n@@ -14,24 +14,59 @@\n You should have received a copy of the GNU Lesser General Public License\n along with this program. If not, see . */\n \n+/* Written by Ulrich Drepper and Bruno Haible. */\n+\n #ifndef STATIC\n #define STATIC static\n #endif\n \n-/* Evaluate the plural expression and return an index value. */\n-STATIC\n-unsigned long int\n-plural_eval (const struct expression *pexp, unsigned long int n)\n+/* While the bison parser is able to support expressions of a maximum depth\n+ of YYMAXDEPTH = 10000, the runtime evaluation of a parsed plural expression\n+ has a smaller maximum recursion depth.\n+ If we did not limit the recursion depth, a program that just invokes\n+ ngettext() on a thread other than the main thread could get a crash by\n+ stack overflow in the following circumstances:\n+ - On systems with glibc, after the stack size has been reduced,\n+ e.g. on x86_64 systems after \"ulimit -s 260\".\n+ This stack size is only sufficient for ca. 3919 recursions.\n+ Cf. \n+ - On systems with musl libc, because there the thread stack size (for a\n+ thread other than the main thread) by default is only 128 KB, see\n+ .\n+ - On AIX 7 systems, because there the thread stack size (for a thread\n+ other than the main thread) by default is only 96 KB, see\n+ .\n+ This stack size is only sufficient for between 887 and 1363 recursions,\n+ depending on the compiler and compiler optimization options.\n+ A maximum depth of 100 is a large enough for all practical needs\n+ and also small enough to avoid stack overflow even with small thread stack\n+ sizes. */\n+#ifndef EVAL_MAXDEPTH\n+# define EVAL_MAXDEPTH 100\n+#endif\n+\n+/* A shorthand that denotes a successful evaluation result with a value V. */\n+#define OK(v) (struct eval_result) { .status = PE_OK, .value = (v) }\n+\n+/* Evaluates a plural expression PEXP for n=N, up to ALLOWED_DEPTH. */\n+static struct eval_result\n+plural_eval_recurse (const struct expression *pexp, unsigned long int n,\n+\t\t unsigned int allowed_depth)\n {\n+ if (allowed_depth == 0)\n+ /* The allowed recursion depth is exhausted. */\n+ return (struct eval_result) { .status = PE_STACKOVF };\n+ allowed_depth--;\n+\n switch (pexp->nargs)\n {\n case 0:\n switch (pexp->operation)\n \t{\n \tcase var:\n-\t return n;\n+\t return OK (n);\n \tcase num:\n-\t return pexp->val.num;\n+\t return OK (pexp->val.num);\n \tdefault:\n \t break;\n \t}\n@@ -40,52 +75,73 @@ plural_eval (const struct expression *pexp, unsigned long int n)\n case 1:\n {\n \t/* pexp->operation must be lnot. */\n-\tunsigned long int arg = plural_eval (pexp->val.args[0], n);\n-\treturn ! arg;\n+\tstruct eval_result arg =\n+\t plural_eval_recurse (pexp->val.args[0], n, allowed_depth);\n+\tif (arg.status != PE_OK)\n+\t return arg;\n+\treturn OK (! arg.value);\n }\n case 2:\n {\n-\tunsigned long int leftarg = plural_eval (pexp->val.args[0], n);\n+\tstruct eval_result leftarg =\n+\t plural_eval_recurse (pexp->val.args[0], n, allowed_depth);\n+\tif (leftarg.status != PE_OK)\n+\t return leftarg;\n \tif (pexp->operation == lor)\n-\t return leftarg || plural_eval (pexp->val.args[1], n);\n+\t {\n+\t if (leftarg.value)\n+\t return OK (1);\n+\t struct eval_result rightarg =\n+\t plural_eval_recurse (pexp->val.args[1], n, allowed_depth);\n+\t if (rightarg.status != PE_OK)\n+\t return rightarg;\n+\t return OK (rightarg.value ? 1 : 0);\n+\t }\n \telse if (pexp->operation == land)\n-\t return leftarg && plural_eval (pexp->val.args[1], n);\n+\t {\n+\t if (!leftarg.value)\n+\t return OK (0);\n+\t struct eval_result rightarg =\n+\t plural_eval_recurse (pexp->val.args[1], n, allowed_depth);\n+\t if (rightarg.status != PE_OK)\n+\t return rightarg;\n+\t return OK (rightarg.value ? 1 : 0);\n+\t }\n \telse\n \t {\n-\t unsigned long int rightarg = plural_eval (pexp->val.args[1], n);\n+\t struct eval_result rightarg =\n+\t plural_eval_recurse (pexp->val.args[1], n, allowed_depth);\n+\t if (rightarg.status != PE_OK)\n+\t return rightarg;\n \n \t switch (pexp->operation)\n \t {\n \t case mult:\n-\t\treturn leftarg * rightarg;\n+\t\treturn OK (leftarg.value * rightarg.value);\n \t case divide:\n-#if !INTDIV0_RAISES_SIGFPE\n-\t\tif (rightarg == 0)\n-\t\t raise (SIGFPE);\n-#endif\n-\t\treturn leftarg / rightarg;\n+\t\tif (rightarg.value == 0)\n+\t\t return (struct eval_result) { .status = PE_INTDIV };\n+\t\treturn OK (leftarg.value / rightarg.value);\n \t case module:\n-#if !INTDIV0_RAISES_SIGFPE\n-\t\tif (rightarg == 0)\n-\t\t raise (SIGFPE);\n-#endif\n-\t\treturn leftarg % rightarg;\n+\t\tif (rightarg.value == 0)\n+\t\t return (struct eval_result) { .status = PE_INTDIV };\n+\t\treturn OK (leftarg.value % rightarg.value);\n \t case plus:\n-\t\treturn leftarg + rightarg;\n+\t\treturn OK (leftarg.value + rightarg.value);\n \t case minus:\n-\t\treturn leftarg - rightarg;\n+\t\treturn OK (leftarg.value - rightarg.value);\n \t case less_than:\n-\t\treturn leftarg < rightarg;\n+\t\treturn OK (leftarg.value < rightarg.value);\n \t case greater_than:\n-\t\treturn leftarg > rightarg;\n+\t\treturn OK (leftarg.value > rightarg.value);\n \t case less_or_equal:\n-\t\treturn leftarg <= rightarg;\n+\t\treturn OK (leftarg.value <= rightarg.value);\n \t case greater_or_equal:\n-\t\treturn leftarg >= rightarg;\n+\t\treturn OK (leftarg.value >= rightarg.value);\n \t case equal:\n-\t\treturn leftarg == rightarg;\n+\t\treturn OK (leftarg.value == rightarg.value);\n \t case not_equal:\n-\t\treturn leftarg != rightarg;\n+\t\treturn OK (leftarg.value != rightarg.value);\n \t default:\n \t\tbreak;\n \t }\n@@ -96,10 +152,25 @@ plural_eval (const struct expression *pexp, unsigned long int n)\n case 3:\n {\n \t/* pexp->operation must be qmop. */\n-\tunsigned long int boolarg = plural_eval (pexp->val.args[0], n);\n-\treturn plural_eval (pexp->val.args[boolarg ? 1 : 2], n);\n+\tstruct eval_result boolarg =\n+\t plural_eval_recurse (pexp->val.args[0], n, allowed_depth);\n+\tif (boolarg.status != PE_OK)\n+\t return boolarg;\n+\treturn plural_eval_recurse (pexp->val.args[boolarg.value ? 1 : 2], n,\n+\t\t\t\t allowed_depth);\n }\n }\n /* NOTREACHED */\n- return 0;\n+ return (struct eval_result) { .status = PE_ASSERT };\n+}\n+\n+/* Evaluates a plural expression PEXP for n=N. */\n+STATIC\n+struct eval_result\n+plural_eval (const struct expression *pexp, unsigned long int n)\n+{\n+ return plural_eval_recurse (pexp, n, EVAL_MAXDEPTH);\n }\n+\n+#undef OK\n+\ndiff --git a/intl/plural-exp.h b/intl/plural-exp.h\nindex f0d3a611e1..e2e0c30563 100644\n--- a/intl/plural-exp.h\n+++ b/intl/plural-exp.h\n@@ -26,6 +26,7 @@\n extern \"C\" {\n #endif\n \n+/* Parsing a plural expression. */\n \n enum expression_operator\n {\n@@ -109,8 +110,26 @@ extern void EXTRACT_PLURAL_EXPRESSION (const char *nullentry,\n \t\t\t\t unsigned long int *npluralsp)\n attribute_hidden;\n \n+/* Evaluating a parsed plural expression. */\n+\n+enum eval_status\n+{\n+ PE_OK, /* Evaluation succeeded, produced a value */\n+ PE_INTDIV, /* Integer division by zero */\n+ PE_INTOVF, /* Integer overflow */\n+ PE_STACKOVF, /* Stack overflow */\n+ PE_ASSERT /* Assertion failure */\n+};\n+\n+struct eval_result\n+{\n+ enum eval_status status;\n+ unsigned long int value; /* Only relevant for status == PE_OK */\n+};\n+\n+\n #if !defined (_LIBC) && !defined (IN_LIBINTL) && !defined (IN_LIBGLOCALE)\n-extern unsigned long int plural_eval (const struct expression *pexp,\n+extern struct eval_result plural_eval (const struct expression *pexp,\n \t\t\t\t unsigned long int n);\n #endif\n \n","prefixes":["v3","1/2"]}