#47614 - [security] Chunked store references in .zo files in Racket 8

Package	Source(s)		Maintainer(s)
guix		PTS Buildd Popcon

Message #19 received at 47614@debbugs.gnu.org (full text, mbox, reply):

Received: (at 47614) by debbugs.gnu.org; 7 Apr 2021 01:48:44 +0000
From debbugs-submit-bounces@debbugs.gnu.org Tue Apr 06 21:48:44 2021
Received: from localhost ([127.0.0.1]:42645 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1lTxJE-0007se-GC
	for submit@debbugs.gnu.org; Tue, 06 Apr 2021 21:48:44 -0400
Received: from mail-qk1-f176.google.com ([209.85.222.176]:36466)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <philip@philipmcgrath.com>) id 1lTxJC-0007sS-Bo
 for 47614@debbugs.gnu.org; Tue, 06 Apr 2021 21:48:43 -0400
Received: by mail-qk1-f176.google.com with SMTP id c4so17215249qkg.3
 for <47614@debbugs.gnu.org>; Tue, 06 Apr 2021 18:48:42 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=philipmcgrath.com; s=google;
 h=subject:references:to:from:message-id:date:user-agent:mime-version
 :in-reply-to:content-language:content-transfer-encoding;
 bh=TC9M1/7KxaFEkPgP1zYLPFVVOmqewfiUKZvJNvU5xk8=;
 b=KewtNXDXmmQOD1dLHvRCPgFM6Ruw/eHxHr48sWLHbosHCuey5hJQVvMCkd/w5BlkiY
 z4ZOKQwyHUhu+Q7kz23IwOEWUofVuJHmhKdVVuza8BJ40We0TvdzGVqq4pPu4qLZ8l/p
 n3e8RO+DBUZ1AzBUnIK7DaF49XMomAm73fd5ryoGC+j+h+IPeX4NdQIKaLWyRK5cW1y3
 0ERqQrUtRDfdhBuVhv+IKyggeixB/lsDKjMoppdoTq43Uq15eiivu6VrZeil+24/5ZA6
 fuDLiSfy2R79JAGnAvJFHC09PXIrzqXFSDgOSBVY3yn4D4RC9phW2xyjR0MbT0CAoQwu
 Sr+Q==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20161025;
 h=x-gm-message-state:subject:references:to:from:message-id:date
 :user-agent:mime-version:in-reply-to:content-language
 :content-transfer-encoding;
 bh=TC9M1/7KxaFEkPgP1zYLPFVVOmqewfiUKZvJNvU5xk8=;
 b=qSJ4SCd2sw7U7OM4Qh6YQFnsoCEZmnPpcfhK0Hsp4udG6Dj57jgVL8f90boPtFpGhT
 Xg+K5kZObJybpCRsu0pZVKNGKZBZSmgVAUGc1jyQOvg2L05z48Sz1q9n3vDR8KxNB9NA
 oBbpui0fnOQjt7FPuEXMYnag3Zc+XL8UPrmXLmuJRu285gRntVWwjPH8shAo8oYKs2i9
 1NR64qxDBK5i0at4M54xevuCbv5VYHCK6r0D9BYMbblr1rTsHo3VsqH6RDLC7SzVAF8q
 7nC3OFVn5uFCJhn1DdgIsL6VBDPPrWlEUzlynqhrhMX8ZCmR4aMB/lrVxBa3WsfKsfbx
 1yfA==
X-Gm-Message-State: AOAM5334ezcdhcbnSWLuqzsOZNDyzqnAYLsuYh/fHWnNAyr2c3IZ+VBU
 ySQqjJ/C+TVAoEa0XrdgXIuSOC3OLWZNEgt6PYg=
X-Google-Smtp-Source: ABdhPJxqTuvBXKFGDmMChF2k7KApDmwVWwUwQU/xtlaG7TBywYbe5KxmpcFZB1gCHANkoIxm2ljrRQ==
X-Received: by 2002:a37:a281:: with SMTP id l123mr904503qke.218.1617760116458; 
 Tue, 06 Apr 2021 18:48:36 -0700 (PDT)
Received: from Sapientia.local (c-73-125-89-242.hsd1.fl.comcast.net.
 [73.125.89.242])
 by smtp.gmail.com with ESMTPSA id g3sm15981128qth.66.2021.04.06.18.48.35
 for <47614@debbugs.gnu.org>
 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);
 Tue, 06 Apr 2021 18:48:35 -0700 (PDT)
Subject: [security] Chunked store references in .zo files in Racket 8 #47614
References: <7eaf8b95-5550-66e1-fda2-d691255b49d7@philipmcgrath.com>
To: 47614@debbugs.gnu.org
From: Philip McGrath <philip@philipmcgrath.com>
X-Forwarded-Message-Id: <7eaf8b95-5550-66e1-fda2-d691255b49d7@philipmcgrath.com>
Message-ID: <2abc59d0-905e-ab0c-ae25-bf572f34fcd5@philipmcgrath.com>
Date: Tue, 6 Apr 2021 21:48:34 -0400
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:78.0)
 Gecko/20100101 Thunderbird/78.9.0
MIME-Version: 1.0
In-Reply-To: <7eaf8b95-5550-66e1-fda2-d691255b49d7@philipmcgrath.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 8bit
X-Spam-Score: 0.7 (/)
X-Debbugs-Envelope-To: 47614
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -0.3 (/)

Ah, I see the thread for https://issues.guix.gnu.org/47614 wasn't cc'ed 
here:

-------- Forwarded Message --------
Subject: Re: Racket 8 and store references (was [security] Chunked store 
references in .zo files in Racket 8 #47614)
Date: Tue, 6 Apr 2021 21:38:57 -0400
From: Philip McGrath <philip@philipmcgrath.com>
To: Jack Hill <jackhill@jackhill.us>, Mark H Weaver <mhw@netris.org>
CC: guix-devel@gnu.org

Indeed, I expect this is a more precise diagnosis of the same problem. 
My patch in https://issues.guix.gnu.org/47180 solves it by putting the 
store references (search paths for foreign libraries) in a configuration 
data file that isn't compiled, so they don't end up in .zo files in the 
first place.

The .zo format is intentionally undocumented and subject to breaking 
change, including from different compilation options. At a minimum, a 
change to the Racket version number signals a breaking change to 
compiled code (e.g. Git is now at 8.0.0.13, so 13 breaking changes since 
the release). Internally, I don't know all the details, but the normal 
8.0 .zo format has a Racket layer around the Chez Scheme object format, 
which seems to be very complex: it looks like it supports 
user-configurable compression at the granularity of the individual 
object within an object file. So it seems much better to avoid rewriting 
.zo files altogether.

-Philip

On 4/6/21 9:20 PM, Jack Hill wrote:
> On Tue, 6 Apr 2021, Mark H Weaver wrote:
> 
>> Anyway, I doubt that imposing such a limitation would adequately solve
>> the problem here of chunked references in Racket 8, because I suspect
>> that Racket 8 could split store references at arbitrary points in the
>> string.  I doubt that we can safely assume that the hash component of
>> store references will be stored contiguously in *.zo files.
> 
> Mark and everyone,
> 
> I wanted to spin off a subthread on guix-devel, to make you aware of 
> another problem that we've run into with reference in .zo getting 
> mangled: https://issues.guix.gnu.org/47180
> 
> Best,
> Jack
>

Display info messages

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sun Dec 22 01:16:57 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

#47614 [security] Chunked store references in .zo files in Racket 8