|
| 1 | +From 9bb92f7a685e31e10e9e8221d0342280432ce836 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Milan Crha <mcrha@redhat.com> |
| 3 | +Date: Tue, 15 Apr 2025 12:17:39 +0200 |
| 4 | +Subject: [PATCH 1/2] soup-message-headers: Correct merge of ranges |
| 5 | + |
| 6 | +It had been skipping every second range, which generated an array |
| 7 | +of a lot of insane ranges, causing large memory usage by the server. |
| 8 | + |
| 9 | +Closes #428 |
| 10 | + |
| 11 | +Part-of: <https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/452> |
| 12 | +--- |
| 13 | + libsoup/soup-message-headers.c | 1 + |
| 14 | + tests/meson.build | 1 + |
| 15 | + tests/server-mem-limit-test.c | 144 +++++++++++++++++++++++++++++++++ |
| 16 | + 3 files changed, 146 insertions(+) |
| 17 | + create mode 100644 tests/server-mem-limit-test.c |
| 18 | + |
| 19 | +diff --git a/libsoup/soup-message-headers.c b/libsoup/soup-message-headers.c |
| 20 | +index 8eec4200..e799082b 100644 |
| 21 | +--- a/libsoup/soup-message-headers.c |
| 22 | ++++ b/libsoup/soup-message-headers.c |
| 23 | +@@ -1244,6 +1244,7 @@ soup_message_headers_get_ranges_internal (SoupMessageHeaders *hdrs, |
| 24 | + if (cur->start <= prev->end) { |
| 25 | + prev->end = MAX (prev->end, cur->end); |
| 26 | + g_array_remove_index (array, i); |
| 27 | ++ i--; |
| 28 | + } |
| 29 | + } |
| 30 | + } |
| 31 | +diff --git a/tests/meson.build b/tests/meson.build |
| 32 | +index 02924c03..ac892359 100644 |
| 33 | +--- a/tests/meson.build |
| 34 | ++++ b/tests/meson.build |
| 35 | +@@ -103,6 +103,7 @@ tests = [ |
| 36 | + {'name': 'samesite'}, |
| 37 | + {'name': 'session'}, |
| 38 | + {'name': 'server-auth'}, |
| 39 | ++ {'name': 'server-mem-limit'}, |
| 40 | + {'name': 'server'}, |
| 41 | + {'name': 'sniffing', |
| 42 | + 'depends': [test_resources], |
| 43 | +diff --git a/tests/server-mem-limit-test.c b/tests/server-mem-limit-test.c |
| 44 | +new file mode 100644 |
| 45 | +index 00000000..98f1c40f |
| 46 | +--- /dev/null |
| 47 | ++++ b/tests/server-mem-limit-test.c |
| 48 | +@@ -0,0 +1,144 @@ |
| 49 | ++/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 8 -*- */ |
| 50 | ++/* |
| 51 | ++ * Copyright (C) 2025 Red Hat <www.redhat.com> |
| 52 | ++ */ |
| 53 | ++ |
| 54 | ++#include "test-utils.h" |
| 55 | ++ |
| 56 | ++#include <sys/resource.h> |
| 57 | ++ |
| 58 | ++/* |
| 59 | ++ This test limits memory usage to trigger too large buffer allocation crash. |
| 60 | ++ As restoring the limits back to what it was does not always work, it's split |
| 61 | ++ out of the server-test.c test with copied minimal server code. |
| 62 | ++ */ |
| 63 | ++ |
| 64 | ++typedef struct { |
| 65 | ++ SoupServer *server; |
| 66 | ++ GUri *base_uri, *ssl_base_uri; |
| 67 | ++ GSList *handlers; |
| 68 | ++} ServerData; |
| 69 | ++ |
| 70 | ++static void |
| 71 | ++server_setup_nohandler (ServerData *sd, gconstpointer test_data) |
| 72 | ++{ |
| 73 | ++ sd->server = soup_test_server_new (SOUP_TEST_SERVER_IN_THREAD); |
| 74 | ++ sd->base_uri = soup_test_server_get_uri (sd->server, "http", NULL); |
| 75 | ++ if (tls_available) |
| 76 | ++ sd->ssl_base_uri = soup_test_server_get_uri (sd->server, "https", NULL); |
| 77 | ++} |
| 78 | ++ |
| 79 | ++static void |
| 80 | ++server_add_handler (ServerData *sd, |
| 81 | ++ const char *path, |
| 82 | ++ SoupServerCallback callback, |
| 83 | ++ gpointer user_data, |
| 84 | ++ GDestroyNotify destroy) |
| 85 | ++{ |
| 86 | ++ soup_server_add_handler (sd->server, path, callback, user_data, destroy); |
| 87 | ++ sd->handlers = g_slist_prepend (sd->handlers, g_strdup (path)); |
| 88 | ++} |
| 89 | ++ |
| 90 | ++static void |
| 91 | ++server_setup (ServerData *sd, gconstpointer test_data) |
| 92 | ++{ |
| 93 | ++ server_setup_nohandler (sd, test_data); |
| 94 | ++} |
| 95 | ++ |
| 96 | ++static void |
| 97 | ++server_teardown (ServerData *sd, gconstpointer test_data) |
| 98 | ++{ |
| 99 | ++ GSList *iter; |
| 100 | ++ |
| 101 | ++ for (iter = sd->handlers; iter; iter = iter->next) |
| 102 | ++ soup_server_remove_handler (sd->server, iter->data); |
| 103 | ++ g_slist_free_full (sd->handlers, g_free); |
| 104 | ++ |
| 105 | ++ g_clear_pointer (&sd->server, soup_test_server_quit_unref); |
| 106 | ++ g_clear_pointer (&sd->base_uri, g_uri_unref); |
| 107 | ++ g_clear_pointer (&sd->ssl_base_uri, g_uri_unref); |
| 108 | ++} |
| 109 | ++ |
| 110 | ++static void |
| 111 | ++server_file_callback (SoupServer *server, |
| 112 | ++ SoupServerMessage *msg, |
| 113 | ++ const char *path, |
| 114 | ++ GHashTable *query, |
| 115 | ++ gpointer data) |
| 116 | ++{ |
| 117 | ++ void *mem; |
| 118 | ++ |
| 119 | ++ g_assert_cmpstr (path, ==, "/file"); |
| 120 | ++ g_assert_cmpstr (soup_server_message_get_method (msg), ==, SOUP_METHOD_GET); |
| 121 | ++ |
| 122 | ++ mem = g_malloc0 (sizeof (char) * 1024 * 1024); |
| 123 | ++ /* fedora-scan CI claims a warning about possibly leaked `mem` variable, thus use |
| 124 | ++ the copy and free it explicitly, to workaround the false positive; the g_steal_pointer() |
| 125 | ++ did not help for the malloc-ed memory */ |
| 126 | ++ soup_server_message_set_response (msg, "application/octet-stream", SOUP_MEMORY_COPY, mem, sizeof (char) * 1024 *1024); |
| 127 | ++ soup_server_message_set_status (msg, SOUP_STATUS_OK, NULL); |
| 128 | ++ g_free (mem); |
| 129 | ++} |
| 130 | ++ |
| 131 | ++static void |
| 132 | ++do_ranges_overlaps_test (ServerData *sd, gconstpointer test_data) |
| 133 | ++{ |
| 134 | ++ SoupSession *session; |
| 135 | ++ SoupMessage *msg; |
| 136 | ++ GString *range; |
| 137 | ++ GUri *uri; |
| 138 | ++ const char *chunk = ",0,0,0,0,0,0,0,0,0,0,0"; |
| 139 | ++ |
| 140 | ++ g_test_bug ("428"); |
| 141 | ++ |
| 142 | ++ #ifdef G_OS_WIN32 |
| 143 | ++ g_test_skip ("Cannot run under windows"); |
| 144 | ++ return; |
| 145 | ++ #endif |
| 146 | ++ |
| 147 | ++ range = g_string_sized_new (99 * 1024); |
| 148 | ++ g_string_append (range, "bytes=1024"); |
| 149 | ++ while (range->len < 99 * 1024) |
| 150 | ++ g_string_append (range, chunk); |
| 151 | ++ |
| 152 | ++ session = soup_test_session_new (NULL); |
| 153 | ++ server_add_handler (sd, "/file", server_file_callback, NULL, NULL); |
| 154 | ++ |
| 155 | ++ uri = g_uri_parse_relative (sd->base_uri, "/file", SOUP_HTTP_URI_FLAGS, NULL); |
| 156 | ++ |
| 157 | ++ msg = soup_message_new_from_uri ("GET", uri); |
| 158 | ++ soup_message_headers_append (soup_message_get_request_headers (msg), "Range", range->str); |
| 159 | ++ |
| 160 | ++ soup_test_session_send_message (session, msg); |
| 161 | ++ |
| 162 | ++ soup_test_assert_message_status (msg, SOUP_STATUS_PARTIAL_CONTENT); |
| 163 | ++ |
| 164 | ++ g_object_unref (msg); |
| 165 | ++ |
| 166 | ++ g_string_free (range, TRUE); |
| 167 | ++ g_uri_unref (uri); |
| 168 | ++ |
| 169 | ++ soup_test_session_abort_unref (session); |
| 170 | ++} |
| 171 | ++ |
| 172 | ++int |
| 173 | ++main (int argc, char **argv) |
| 174 | ++{ |
| 175 | ++ int ret; |
| 176 | ++ |
| 177 | ++ test_init (argc, argv, NULL); |
| 178 | ++ |
| 179 | ++ #ifndef G_OS_WIN32 |
| 180 | ++ struct rlimit new_rlimit = { 1024 * 1024 * 64, 1024 * 1024 * 64 }; |
| 181 | ++ /* limit memory usage, to trigger too large memory allocation abort */ |
| 182 | ++ g_assert_cmpint (setrlimit (RLIMIT_DATA, &new_rlimit), ==, 0); |
| 183 | ++ #endif |
| 184 | ++ |
| 185 | ++ g_test_add ("/server-mem/range-overlaps", ServerData, NULL, |
| 186 | ++ server_setup, do_ranges_overlaps_test, server_teardown); |
| 187 | ++ |
| 188 | ++ ret = g_test_run (); |
| 189 | ++ |
| 190 | ++ test_cleanup (); |
| 191 | ++ return ret; |
| 192 | ++} |
| 193 | +-- |
| 194 | +GitLab |
| 195 | + |
| 196 | + |
| 197 | +From eeace39ec686094ff6a05a43e5fce06e9c37f376 Mon Sep 17 00:00:00 2001 |
| 198 | +From: Milan Crha <mcrha@redhat.com> |
| 199 | +Date: Tue, 13 May 2025 14:20:46 +0200 |
| 200 | +Subject: [PATCH 2/2] server-mem-limit-test: Limit memory usage only when not |
| 201 | + built witha sanitizer |
| 202 | + |
| 203 | +A build with -Db_sanitize=address crashes with failed mmap(), which is done |
| 204 | +inside libasan. The test requires 20.0TB of virtual memory when running with |
| 205 | +the sanitizer, which is beyond unsigned integer limits and may not trigger |
| 206 | +the bug anyway. |
| 207 | + |
| 208 | +Part-of: <https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/452> |
| 209 | +--- |
| 210 | + meson.build | 4 ++++ |
| 211 | + tests/server-mem-limit-test.c | 13 +++++++++---- |
| 212 | + 2 files changed, 13 insertions(+), 4 deletions(-) |
| 213 | + |
| 214 | +diff --git a/meson.build b/meson.build |
| 215 | +index 8772a0ea..b31a8791 100644 |
| 216 | +--- a/meson.build |
| 217 | ++++ b/meson.build |
| 218 | +@@ -357,6 +357,10 @@ configinc = include_directories('.') |
| 219 | + |
| 220 | + prefix = get_option('prefix') |
| 221 | + |
| 222 | ++if get_option('b_sanitize') != 'none' |
| 223 | ++ cdata.set_quoted('B_SANITIZE_OPTION', get_option('b_sanitize')) |
| 224 | ++endif |
| 225 | ++ |
| 226 | + cdata.set_quoted('PACKAGE_VERSION', soup_version) |
| 227 | + cdata.set_quoted('LOCALEDIR', join_paths(prefix, get_option('localedir'))) |
| 228 | + cdata.set_quoted('GETTEXT_PACKAGE', libsoup_api_name) |
| 229 | +diff --git a/tests/server-mem-limit-test.c b/tests/server-mem-limit-test.c |
| 230 | +index 98f1c40f..65dc875e 100644 |
| 231 | +--- a/tests/server-mem-limit-test.c |
| 232 | ++++ b/tests/server-mem-limit-test.c |
| 233 | +@@ -126,14 +126,19 @@ main (int argc, char **argv) |
| 234 | + { |
| 235 | + int ret; |
| 236 | + |
| 237 | +- test_init (argc, argv, NULL); |
| 238 | +- |
| 239 | +- #ifndef G_OS_WIN32 |
| 240 | +- struct rlimit new_rlimit = { 1024 * 1024 * 64, 1024 * 1024 * 64 }; |
| 241 | ++ /* a build with an address sanitizer may crash on mmap() with the limit, |
| 242 | ++ thus skip the limit set in such case, even it may not necessarily |
| 243 | ++ trigger the bug if it regresses */ |
| 244 | ++ #if !defined(G_OS_WIN32) && !defined(B_SANITIZE_OPTION) |
| 245 | ++ struct rlimit new_rlimit = { 1024UL * 1024UL * 1024UL * 2UL, 1024UL * 1024UL * 1024UL * 2UL }; |
| 246 | + /* limit memory usage, to trigger too large memory allocation abort */ |
| 247 | + g_assert_cmpint (setrlimit (RLIMIT_DATA, &new_rlimit), ==, 0); |
| 248 | ++ #else |
| 249 | ++ g_message ("server-mem-limit-test: Running without memory limit"); |
| 250 | + #endif |
| 251 | + |
| 252 | ++ test_init (argc, argv, NULL); |
| 253 | ++ |
| 254 | + g_test_add ("/server-mem/range-overlaps", ServerData, NULL, |
| 255 | + server_setup, do_ranges_overlaps_test, server_teardown); |
| 256 | + |
| 257 | +-- |
| 258 | +GitLab |
| 259 | + |
0 commit comments