Skip to content

"error: cannot allocate memory" and crash when defining infinite recursive function #3475

@chinggg

Description

@chinggg

Describe the bug
When defining and using infinite recursive function, latest jq release will crash/abort after around 2s with a memory allocation error.

It seems #519 already discuss about disabling recursion, but I tested two examples there, (eg. jq -n 'def f: f; f') and found them only cause timeout. But my PoC cause the program to crash.

To Reproduce

I found the original PoC when testing the strftime function, which accidentally redefined strftime to be infinite recursion.

jq -n 'def strftime(x): strftime(x); 0 | strftime("")'

a minimal example would be

❯ jq -n 'def a(x): a(x); a(0)'
jq: error: cannot allocate memory
zsh: IOT instruction (core dumped)  jq -n "def a(x): a(x); a(0)"

Building with ASAN will trigger error below

=================================================================
==447421==ERROR: AddressSanitizer: requested allocation size 0xffffffff99248fe0 (0xffffffff99249fe0 after adjustments for alignment, red zones etc.) exceeds maximum supported size of 0x10000000000 (thread T0)
    #0 0x7f5635b62c38 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164
    #1 0x7f56359ab2ac in jv_mem_realloc ../src/jv_alloc.c:184

Expected behavior
The program gracefully exit.

Environment (please complete the following information):

  • OS and Version: Ubunu 22.04 and Arch Linux
  • jq version: jq 1.7 - jq 1.8.1 and latest master commit when submitting issue b33a763

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions