This is an archive of the discontinued Mercurial Phabricator instance.

Differential D3937

ssh: avoid reading beyond the end of stream when using compression
ClosedPublic

Authored by joerg.sonnenberger on Jul 12 2018, 12:46 PM.

Details

Reviewers
durin42
Group Reviewers
hg-reviewers
Commits
rHG27391d74aaa2: ssh: avoid reading beyond the end of stream when using compression
Summary

Compressed streams can be used as part of getbundle. The normal read()
operation of bufferedinputpipe will try to fulfill the request exactly
and can deadlock if the server sends less as it is done. At the same
time, the bundle2 logic will stop reading when it believes it has gotten
all parts of the bundle, which can leave behind end of stream markers as
used by bzip2 and zstd.

To solve this, introduce a new optional unbufferedread interface and
provided it in bufferedinputpipe and doublepipe. If there is buffered
data left, it will be returned, otherwise it will issue a single read
request and return whatever it obtains.

Reorganize the decompression handlers to try harder to read until the
end of stream, especially if the requested read can already be
fulfilled. Check for end of stream is messy with Python 2, none of the
standard compression modules properly exposes it. At least with zstd and
bzip2, decompressing will remember EOS and fail for empty input after
the EOS has been seen. For zlib, the only way to detect it with Python 2
is to duplicate the decompressobj and force some additional data into
it. The common handler can be further optimized, but works as PoC.

Diff Detail

Repository
rHG Mercurial
Lint
Lint Skipped
Unit
Unit Tests Skipped

Event Timeline

durin42 accepted this revision.Jul 16 2018, 4:55 PM
This revision is now accepted and ready to land.Jul 16 2018, 4:55 PM
Closed by commit rHG27391d74aaa2: ssh: avoid reading beyond the end of stream when using compression (authored by joerg.sonnenberger). · Explain WhyJul 16 2018, 4:58 PM
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

PathPackages
Mmercurial/sshpeer.py (11 lines)
Mmercurial/util.py (137 lines)

Diff 9576

mercurial/sshpeer.py

# We've observed a condition that indicates the # We've observed a condition that indicates the
# stdout closed unexpectedly. Check stderr one # stdout closed unexpectedly. Check stderr one
# more time and snag anything that's there before # more time and snag anything that's there before
# letting anyone know the main part of the pipe # letting anyone know the main part of the pipe
# closed prematurely. # closed prematurely.
_forwardoutput(self._ui, self._side) _forwardoutput(self._ui, self._side)
return r return r
def unbufferedread(self, size):
r = self._call('unbufferedread', size)
if size != 0 and not r:
# We've observed a condition that indicates the
# stdout closed unexpectedly. Check stderr one
# more time and snag anything that's there before
# letting anyone know the main part of the pipe
# closed prematurely.
_forwardoutput(self._ui, self._side)
return r
def readline(self): def readline(self):
return self._call('readline') return self._call('readline')
def _call(self, methname, data=None): def _call(self, methname, data=None):
"""call <methname> on "main", forward output of "side" while blocking """call <methname> on "main", forward output of "side" while blocking
""" """
# data can be '' or 0 # data can be '' or 0
if (data is not None and not data) or self._main.closed: if (data is not None and not data) or self._main.closed:

mercurial/util.py

def close(self): def close(self):
return self._input.close() return self._input.close()
def read(self, size): def read(self, size):
while (not self._eof) and (self._lenbuf < size): while (not self._eof) and (self._lenbuf < size):
self._fillbuffer() self._fillbuffer()
return self._frombuffer(size) return self._frombuffer(size)
def unbufferedread(self, size):
if not self._eof and self._lenbuf == 0:
self._fillbuffer(max(size, _chunksize))
return self._frombuffer(min(self._lenbuf, size))
def readline(self, *args, **kwargs): def readline(self, *args, **kwargs):
if 1 < len(self._buffer): if 1 < len(self._buffer):
# this should not happen because both read and readline end with a # this should not happen because both read and readline end with a
# _frombuffer call that collapse it. # _frombuffer call that collapse it.
self._buffer = [''.join(self._buffer)] self._buffer = [''.join(self._buffer)]
self._lenbuf = len(self._buffer[0]) self._lenbuf = len(self._buffer[0])
lfi = -1 lfi = -1
if self._buffer: if self._buffer:
if buf: if buf:
self._buffer = [buf] self._buffer = [buf]
self._lenbuf = len(buf) self._lenbuf = len(buf)
else: else:
self._buffer = [] self._buffer = []
self._lenbuf = 0 self._lenbuf = 0
return data return data
def _fillbuffer(self): def _fillbuffer(self, size=_chunksize):
"""read data to the buffer""" """read data to the buffer"""
data = os.read(self._input.fileno(), _chunksize) data = os.read(self._input.fileno(), size)
if not data: if not data:
self._eof = True self._eof = True
else: else:
self._lenbuf += len(data) self._lenbuf += len(data)
self._buffer.append(data) self._buffer.append(data)
return data return data
data. The method will only be called if ``data`` begins with data. The method will only be called if ``data`` begins with
``revlogheader()``. The method should return the raw, uncompressed ``revlogheader()``. The method should return the raw, uncompressed
data or raise a ``RevlogError``. data or raise a ``RevlogError``.
The object is reusable but is not thread safe. The object is reusable but is not thread safe.
""" """
raise NotImplementedError() raise NotImplementedError()
class _CompressedStreamReader(object):
def __init__(self, fh):
if safehasattr(fh, 'unbufferedread'):
self._reader = fh.unbufferedread
else:
self._reader = fh.read
self._pending = []
self._pos = 0
self._eof = False
def _decompress(self, chunk):
raise NotImplementedError()
def read(self, l):
buf = []
while True:
while self._pending:
if len(self._pending[0]) > l + self._pos:
newbuf = self._pending[0]
buf.append(newbuf[self._pos:self._pos + l])
self._pos += l
return ''.join(buf)
newbuf = self._pending.pop(0)
if self._pos:
buf.append(newbuf[self._pos:])
l -= len(newbuf) - self._pos
else:
buf.append(newbuf)
l -= len(newbuf)
self._pos = 0
if self._eof:
return ''.join(buf)
chunk = self._reader(65536)
self._decompress(chunk)
class _GzipCompressedStreamReader(_CompressedStreamReader):
def __init__(self, fh):
super(_GzipCompressedStreamReader, self).__init__(fh)
self._decompobj = zlib.decompressobj()
def _decompress(self, chunk):
newbuf = self._decompobj.decompress(chunk)
if newbuf:
self._pending.append(newbuf)
d = self._decompobj.copy()
try:
d.decompress('x')
d.flush()
if d.unused_data == 'x':
self._eof = True
except zlib.error:
pass
class _BZ2CompressedStreamReader(_CompressedStreamReader):
def __init__(self, fh):
super(_BZ2CompressedStreamReader, self).__init__(fh)
self._decompobj = bz2.BZ2Decompressor()
def _decompress(self, chunk):
newbuf = self._decompobj.decompress(chunk)
if newbuf:
self._pending.append(newbuf)
try:
while True:
newbuf = self._decompobj.decompress('')
if newbuf:
self._pending.append(newbuf)
else:
break
except EOFError:
self._eof = True
class _TruncatedBZ2CompressedStreamReader(_BZ2CompressedStreamReader):
def __init__(self, fh):
super(_TruncatedBZ2CompressedStreamReader, self).__init__(fh)
newbuf = self._decompobj.decompress('BZ')
if newbuf:
self._pending.append(newbuf)
class _ZstdCompressedStreamReader(_CompressedStreamReader):
def __init__(self, fh, zstd):
super(_ZstdCompressedStreamReader, self).__init__(fh)
self._zstd = zstd
self._decompobj = zstd.ZstdDecompressor().decompressobj()
def _decompress(self, chunk):
newbuf = self._decompobj.decompress(chunk)
if newbuf:
self._pending.append(newbuf)
try:
while True:
newbuf = self._decompobj.decompress('')
if newbuf:
self._pending.append(newbuf)
else:
break
except self._zstd.ZstdError:
self._eof = True
class _zlibengine(compressionengine): class _zlibengine(compressionengine):
def name(self): def name(self):
return 'zlib' return 'zlib'
def bundletype(self): def bundletype(self):
"""zlib compression using the DEFLATE algorithm. """zlib compression using the DEFLATE algorithm.
All Mercurial clients should support this format. The compression All Mercurial clients should support this format. The compression
# Not all calls to compress emit data. It is cheaper to inspect # Not all calls to compress emit data. It is cheaper to inspect
# here than to feed empty chunks through generator. # here than to feed empty chunks through generator.
if data: if data:
yield data yield data
yield z.flush() yield z.flush()
def decompressorreader(self, fh): def decompressorreader(self, fh):
def gen(): return _GzipCompressedStreamReader(fh)
d = zlib.decompressobj()
for chunk in filechunkiter(fh):
while chunk:
# Limit output size to limit memory.
yield d.decompress(chunk, 2 ** 18)
chunk = d.unconsumed_tail
return chunkbuffer(gen())
class zlibrevlogcompressor(object): class zlibrevlogcompressor(object):
def compress(self, data): def compress(self, data):
insize = len(data) insize = len(data)
# Caller handles empty input case. # Caller handles empty input case.
assert insize > 0 assert insize > 0
if insize < 44: if insize < 44:
for chunk in it: for chunk in it:
data = z.compress(chunk) data = z.compress(chunk)
if data: if data:
yield data yield data
yield z.flush() yield z.flush()
def decompressorreader(self, fh): def decompressorreader(self, fh):
def gen(): return _BZ2CompressedStreamReader(fh)
d = bz2.BZ2Decompressor()
for chunk in filechunkiter(fh):
yield d.decompress(chunk)
return chunkbuffer(gen())
compengines.register(_bz2engine()) compengines.register(_bz2engine())
class _truncatedbz2engine(compressionengine): class _truncatedbz2engine(compressionengine):
def name(self): def name(self):
return 'bz2truncated' return 'bz2truncated'
def bundletype(self): def bundletype(self):
return None, '_truncatedBZ' return None, '_truncatedBZ'
# We don't implement compressstream because it is hackily handled elsewhere. # We don't implement compressstream because it is hackily handled elsewhere.
def decompressorreader(self, fh): def decompressorreader(self, fh):
def gen(): return _TruncatedBZ2CompressedStreamReader(fh)
# The input stream doesn't have the 'BZ' header. So add it back.
d = bz2.BZ2Decompressor()
d.decompress('BZ')
for chunk in filechunkiter(fh):
yield d.decompress(chunk)
return chunkbuffer(gen())
compengines.register(_truncatedbz2engine()) compengines.register(_truncatedbz2engine())
class _noopengine(compressionengine): class _noopengine(compressionengine):
def name(self): def name(self):
return 'none' return 'none'
def bundletype(self): def bundletype(self):
for chunk in it: for chunk in it:
data = z.compress(chunk) data = z.compress(chunk)
if data: if data:
yield data yield data
yield z.flush() yield z.flush()
def decompressorreader(self, fh): def decompressorreader(self, fh):
zstd = self._module return _ZstdCompressedStreamReader(fh, self._module)
dctx = zstd.ZstdDecompressor()
return chunkbuffer(dctx.read_from(fh))
class zstdrevlogcompressor(object): class zstdrevlogcompressor(object):
def __init__(self, zstd, level=3): def __init__(self, zstd, level=3):
# TODO consider omitting frame magic to save 4 bytes. # TODO consider omitting frame magic to save 4 bytes.
# This writes content sizes into the frame header. That is # This writes content sizes into the frame header. That is
# extra storage. But it allows a correct size memory allocation # extra storage. But it allows a correct size memory allocation
# to hold the result. # to hold the result.
self._cctx = zstd.ZstdCompressor(level=level) self._cctx = zstd.ZstdCompressor(level=level)