Skip to content

upb: add ASLR-based seed to integer hash function #26907

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MindflareX wants to merge 1 commit into
base: main
Choose a base branch
from
+30 −0
Open

upb: add ASLR-based seed to integer hash function #26907

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions php/ext/google/protobuf/php-upb.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3523,9 +3523,19 @@ typedef bool eqlfunc_t(upb_key k1, upb_value v1, lookupkey_t k2);

/* Base table (shared code) ***************************************************/

// Seed for integer hashing, using the same ASLR-based approach as string
// hashing. Without this seed, the integer hash function is completely
// deterministic, allowing an attacker to trivially precompute colliding keys
// and cause O(N^2) insertion time for N map entries.
static const void* const _upb_int_seed;
UPB_FORCEINLINE uint64_t _upb_IntSeed(void) {
return (uint64_t)(uintptr_t)&_upb_int_seed;
}

static uint32_t upb_inthash(uintptr_t key) {
UPB_STATIC_ASSERT(sizeof(uintptr_t) == 4 || sizeof(uintptr_t) == 8,
"Pointers don't fit");
key ^= (uintptr_t)_upb_IntSeed();
if (sizeof(uintptr_t) == 8) {
return (uint32_t)key ^ (uint32_t)(key >> 32);
} else {
Expand Down
10 changes: 10 additions & 0 deletions ruby/ext/google/protobuf_c/ruby-upb.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2368,9 +2368,19 @@ typedef bool eqlfunc_t(upb_key k1, upb_value v1, lookupkey_t k2);

/* Base table (shared code) ***************************************************/

// Seed for integer hashing, using the same ASLR-based approach as string
// hashing. Without this seed, the integer hash function is completely
// deterministic, allowing an attacker to trivially precompute colliding keys
// and cause O(N^2) insertion time for N map entries.
static const void* const _upb_int_seed;
UPB_FORCEINLINE uint64_t _upb_IntSeed(void) {
return (uint64_t)(uintptr_t)&_upb_int_seed;
}

static uint32_t upb_inthash(uintptr_t key) {
UPB_STATIC_ASSERT(sizeof(uintptr_t) == 4 || sizeof(uintptr_t) == 8,
"Pointers don't fit");
key ^= (uintptr_t)_upb_IntSeed();
if (sizeof(uintptr_t) == 8) {
return (uint32_t)key ^ (uint32_t)(key >> 32);
} else {
Expand Down
10 changes: 10 additions & 0 deletions upb/hash/common.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,9 +106,19 @@ typedef bool eqlfunc_t(upb_key k1, upb_value v1, lookupkey_t k2);

/* Base table (shared code) ***************************************************/

// Seed for integer hashing, using the same ASLR-based approach as string
// hashing. Without this seed, the integer hash function is completely
// deterministic, allowing an attacker to trivially precompute colliding keys
// and cause O(N^2) insertion time for N map entries.
static const void* const _upb_int_seed;
UPB_FORCEINLINE uint64_t _upb_IntSeed(void) {
return (uint64_t)(uintptr_t)&_upb_int_seed;
}

static uint32_t upb_inthash(uintptr_t key) {
UPB_STATIC_ASSERT(sizeof(uintptr_t) == 4 || sizeof(uintptr_t) == 8,
"Pointers don't fit");
key ^= (uintptr_t)_upb_IntSeed();
if (sizeof(uintptr_t) == 8) {
return (uint32_t)key ^ (uint32_t)(key >> 32);
} else {
Expand Down
Loading