You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@logging.apache.org by "OxBat (via GitHub)" <gi...@apache.org> on 2026/01/27 19:04:50 UTC
[PR] Fix: Denial of Service (Stack Overflow & O(N^2) CPU) in OptionConverter [logging-log4cxx]
OxBat opened a new pull request, #590:
URL: https://github.com/apache/logging-log4cxx/pull/590
### Summary
I identified a Denial of Service vulnerability in `OptionConverter::substVars`.
The component handles variable substitution (e.g., `${key}`) recursively.
**The Issues:**
1. **Stack Overflow (Crash):** `substVarsSafely` is recursive but had no depth limit. A configuration with deeply nested variables (e.g., 20,000 levels) caused a Segmentation Fault.
2. **Algorithmic Complexity (Freeze):** The cycle detection logic used a linked list (`LogStringChain`) that required traversing the parent chain at every step, resulting in O(N^2) complexity.
**The Fix:**
I refactored the internal `substVarsSafely` function:
1. Replaced the custom `LogStringChain` linked list with a `std::vector<LogString>` for history tracking (faster lookup).
2. Added a `MAX_SUBST_DEPTH` (20). If recursion exceeds this depth, it stops and logs a warning, preventing the crash.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix: Denial of Service (Stack Overflow & O(N^2) CPU) in OptionConverter [logging-log4cxx]
Posted by "OxBat (via GitHub)" <gi...@apache.org>.
OxBat commented on PR #590:
URL: https://github.com/apache/logging-log4cxx/pull/590#issuecomment-3818158978
The existing test only catches circular dependencies (loops). My fix targets stack overflows caused by deep recursion without loops.
I just added `varSubstDepthLimitTest` to cover this specific case (it builds a chain of 25 items to ensure we stop gracefully at the limit).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix: Denial of Service (Stack Overflow & O(N^2) CPU) in OptionConverter [logging-log4cxx]
Posted by "rm5248 (via GitHub)" <gi...@apache.org>.
rm5248 commented on PR #590:
URL: https://github.com/apache/logging-log4cxx/pull/590#issuecomment-3815262874
there's actually already a test case for recursive: https://github.com/apache/logging-log4cxx/blob/28a443edaf226b37996bc653aed9b4d666785458/src/test/cpp/helpers/optionconvertertestcase.cpp#L149
Why is that test not failing, or is that test not properly catching the problem that this is fixing?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix: Denial of Service (Stack Overflow & O(N^2) CPU) in OptionConverter [logging-log4cxx]
Posted by "swebb2066 (via GitHub)" <gi...@apache.org>.
swebb2066 closed pull request #590: Fix: Denial of Service (Stack Overflow & O(N^2) CPU) in OptionConverter
URL: https://github.com/apache/logging-log4cxx/pull/590
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix: Denial of Service (Stack Overflow & O(N^2) CPU) in OptionConverter [logging-log4cxx]
Posted by "rm5248 (via GitHub)" <gi...@apache.org>.
rm5248 commented on PR #590:
URL: https://github.com/apache/logging-log4cxx/pull/590#issuecomment-3815256311
can you add a unit test to ensure that this is working correctly? This unit test can be added to the already existing `optioncovertertestcase.cpp`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org