https://bugs.exim.org/show_bug.cgi?id=2334
--- Comment #7 from Rich Siegel <siegel@???> ---
Created attachment 1147
-->
https://bugs.exim.org/attachment.cgi?id=1147&action=edit
Patch for src/sljit/sljitExecAllocator.c to check code sign flags
Here is a proposed patch. There's a lot that I don't like about it, but it
implements the solution I proposed.
With this patch in place, pcre2_jit_test passes when run on macOS, and clients
running on macOS 10.14 with the "hardened runtime" behave correctly (more
testing is pending).
The problems I have with it:
- I had to borrow a constant from the 10.14 SDK headers, so that people
building using older SDKs wouldn't have compile errors.
- The "@available" check is only available to Objective-C code, so I had to put
in an explicit check for the running OS version, based on the results of
sysctl("kern.osrelease", ...).
- in order for the compiled tools to link, I had to set CMAKE_C_FLAGS to
"-framework Foundation -framework Security" so that the appropriate system
frameworks got linked in. I don't know if there's a way to do that in a
conditional fashion.
All that being said: if the last problem can be addressed, and you choose to
integrate this, it should be serviceable for anyone building pcre2 on macOS and
it's conditionalized on #ifdef MAP_JIT which is Darwin-specific, so non-Mac
users should notice no difference.
An alternative solution would be to make this issue the user's problem: add a
JIT option flag (maybe as an "extra" flag in pcre2_compile_context) that says
that the client requires pcre2 to use MAP_JIT in cases where a block is being
mapped in for execution.
Then, the client code would be obligated to compute this flag correctly at
runtime (using some variant of the code I wrote) and specify the option
accordingly. In that case, my patch is unnecessary and wherever the option is
set, the JIT allocator can query that flag and set MAP_JIT if indicated.
--
You are receiving this mail because:
You are on the CC list for the bug.
