Query cancel in regex library

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: pgsql-hackers(at)postgreSQL(dot)org
Subject: Query cancel in regex library
Date: 2014-03-01 00:40:09
Message-ID: 25197.1393634409@sss.pgh.pa.us
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

We have a couple of open bug reports in which the regex library takes
unreasonable amounts of time and/or memory to process a regexp. While
I have hopes that both of the known issues can be improved, it seems
likely that there will always be cases where sufficiently complicated
regexps just take too long. Right now, any such case is an effective
DOS since the regex code contains no provisions for detecting a pending
query cancel: the backend just locks up for however long it takes,
unless it runs out of memory. I've resisted adding such provisions
because I have hopes of making that code into a standalone library someday
... but I think it's time to capitulate. Arguably, other applications
making use of a regex library could want query-cancel support too, so as
long as there's an API for specifying a callback function to detect a
pending query cancel, this doesn't seem any worse than some of the other
things we've done to Spencer's code.

In the attached proposed patch, I've not actually invented such an API,
but I have encapsulated the cancel check in an internal callback function,
so that it wouldn't take much more work to add an API for setting a
different callback function.

I don't claim that the two places I added cancel checks necessarily
provide 100% coverage of long code paths in the library; but they're
pretty central to regex compilation and execution respectively, and
they do stop the two known problem cases quite quickly. We can always
add more checks if found necessary.

Barring objection or better ideas, I propose to back-patch this into
all live branches.

regards, tom lane

Attachment Content-Type Size
regex-query-cancel.patch text/x-diff 6.2 KB

Browse pgsql-hackers by date

  From Date Subject
Next Message Noah Misch 2014-03-01 01:15:59 Securing "make check" (CVE-2014-0067)
Previous Message Kohei KaiGai 2014-03-01 00:00:25 Re: Custom Scan APIs (Re: Custom Plan node)