Ticket #111: omindex-limit-filter-resource-usage.patch

runfilter.cc

@@ -19 +19 @@
 
 #include <config.h>
 
+#include <iostream>
 #include <string>
 
+#include <limits.h>
+#include "safeerrno.h"
 #include <sys/types.h>
 #include <stdio.h>
 #include "safefcntl.h"
+
+#include <sys/time.h>
+#include <sys/resource.h>
 #ifdef HAVE_SYS_WAIT_H
 # include <sys/wait.h>
 #endif
+#include <sys/socket.h>
+#include "safeunistd.h"
 
 #include "runfilter.h"
 
@@ -50 +58 @@
 stdout_to_string(const string &cmd)
 {
     string out;
+#ifdef HAVE_FORK
+    // We want to be able to get the exit status of the child process.
+    signal(SIGCHLD, SIG_DFL);
+
+    int fds[2];
+    if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, fds) < 0)
+        throw ReadError();
+
+    pid_t child = fork();
+    if (child == 0) {
+        // We're the child process.
+
+        // Close the parent's side of the socket pair.
+        close(fds[0]);
+
+        // Connect stdout to our side of the socket pair.
+        dup2(fds[1], 1);
+
+        // Limit CPU time to 300 seconds (5 minutes).
+        struct rlimit cpu_limit = { 300, RLIM_INFINITY } ;
+        setrlimit(RLIMIT_CPU, &cpu_limit);
+
+        // Limit process data to 7/8 of free physical memory.
+        static long pagesize = 0;
+        if (pagesize == 0) pagesize = sysconf(_SC_PAGESIZE);
+
+        if (pagesize > 0) {
+            long mem = sysconf(_SC_AVPHYS_PAGES);
+            if (mem > 0) {
+                if (mem >= LONG_MAX / pagesize) {
+                    mem = LONG_MAX;
+                } else {
+                    mem *= pagesize;
+                }
+
+                mem = (mem / 8) * 7;
+                struct rlimit ram_limit = { mem, RLIM_INFINITY } ;
+                setrlimit(RLIMIT_DATA, &ram_limit);
+            }
+        }
+
+        execl("/bin/sh", "/bin/sh", "-c", cmd.c_str(), (void*)NULL);
+        _exit(-1);
+    }
+
+    // We're the parent process.
+
+    // Close the child's side of the socket pair.
+    close(fds[1]);
+    if (child == -1) {
+        // fork() failed.
+        close(fds[0]);
+        throw ReadError();
+    }
+
+    int fd = fds[0];
+
+    while (true) {
+        char buf[4096];
+        ssize_t res = read(fd, buf, sizeof(buf));
+        if (res == 0) break;
+        if (res == -1) {
+            if (errno != EINTR) {
+                close(fd);
+                int status;
+                (void)waitpid(child, &status, 0);
+                throw ReadError();
+            }
+        }
+        out.append(buf, res);
+    }
+
+    close(fd);
+    int status;
+    if (waitpid(child, &status, 0) == -1) {
+        throw ReadError();
+    }
+#else
     FILE * fh = popen(cmd.c_str(), "r");
     if (fh == NULL) throw ReadError();
     while (!feof(fh)) {
@@ -62 +148 @@
         out.append(buf, len);
     }
     int status = pclose(fh);
+#endif
+
     if (status != 0) {
         if (WIFEXITED(status) && WEXITSTATUS(status) == 127) {
             throw NoSuchFilter();
         }
+#ifdef SIGXCPU
+        if (WIFSIGNALED(status) && WTERMSIG(status) == SIGXCPU) {
+            cerr << "Filter process consumed too much CPU time" << endl;
+        }
+#endif
         throw ReadError();
     }
     return out;

configure.ac

@@ -74 +74 @@
 AC_FUNC_STRFTIME
 AC_CHECK_FUNCS(gettimeofday ftime)
 
-dnl See if ftime returns void (as it does on mingw)
+dnl See if ftime() returns void (as it does on mingw).
 if test $ac_cv_func_ftime = yes ; then
   AC_TRY_COMPILE([#include <sys/timeb.h>],
     [struct timeb tp; int i = ftime(&tp);],
@@ -82 +82 @@
     AC_DEFINE(FTIME_RETURNS_VOID, 1, [Define if ftime returns void]))
 fi
 
-dnl Check for lstat (not available under mingw for example).
+dnl Check for lstat() (not available under mingw for example).
 AC_CHECK_FUNCS(lstat)
 
-dnl Add in portable replacement for mkdtemp on platforms which lack it.
+dnl omindex uses fork() under UNIX.
+AC_CHECK_FUNCS(fork)
+
+dnl Add in portable replacement for mkdtemp() on platforms which lack it.
 AC_CHECK_FUNCS(mkdtemp)
 AM_CONDITIONAL(NEED_MKDTEMP, [test yes != "$ac_cv_func_mkdtemp"])