[3/3] wcsmbs: Ensure wcstr worst-case linear execution time (BZ 23865)

It uses the same two-way algorithm used on strstr, strcasestr, and
memmem.  Different than strstr, neither the "shift table" optimization
nor the self-adapting filtering check is used because it would result in
a too-large shift table (and it also simplifies the implementation bit).

Checked on x86_64-linux-gnu and aarch64-linux-gnu.
---
 wcsmbs/wcs-two-way.h | 312 +++++++++++++++++++++++++++++++++++++++++++
 wcsmbs/wcsstr.c      | 104 +++++----------
 2 files changed, 344 insertions(+), 72 deletions(-)
 create mode 100644 wcsmbs/wcs-two-way.h

On Mon, Feb 19, 2024 at 8:45 PM Adhemerval Zanella
<adhemerval.zanella@linaro.org> wrote:
>
> It uses the same two-way algorithm used on strstr, strcasestr, and
> memmem.  Different than strstr, neither the "shift table" optimization
> nor the self-adapting filtering check is used because it would result in
> a too-large shift table (and it also simplifies the implementation bit).
>
> Checked on x86_64-linux-gnu and aarch64-linux-gnu.
> ---
>  wcsmbs/wcs-two-way.h | 312 +++++++++++++++++++++++++++++++++++++++++++
>  wcsmbs/wcsstr.c      | 104 +++++----------
>  2 files changed, 344 insertions(+), 72 deletions(-)
>  create mode 100644 wcsmbs/wcs-two-way.h
>
> diff --git a/wcsmbs/wcs-two-way.h b/wcsmbs/wcs-two-way.h
> new file mode 100644
> index 0000000000..2dcee7fc1a
> --- /dev/null
> +++ b/wcsmbs/wcs-two-way.h
> @@ -0,0 +1,312 @@
> +/* Byte-wise substring search, using the Two-Way algorithm.
> +   Copyright (C) 2024 Free Software Foundation, Inc.
> +   This file is part of the GNU C Library.
> +
> +   The GNU C Library is free software; you can redistribute it and/or
> +   modify it under the terms of the GNU Lesser General Public
> +   License as published by the Free Software Foundation; either
> +   version 2.1 of the License, or (at your option) any later version.
> +
> +   The GNU C Library is distributed in the hope that it will be useful,
> +   but WITHOUT ANY WARRANTY; without even the implied warranty of
> +   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
> +   Lesser General Public License for more details.
> +
> +   You should have received a copy of the GNU Lesser General Public
> +   License along with the GNU C Library; if not, see
> +   <https://www.gnu.org/licenses/>.  */
> +
> +/* Before including this file, you need to include <string.h> (and
> +   <config.h> before that, if not part of libc), and define:
> +     AVAILABLE(h, h_l, j, n_l)
> +                            A macro that returns nonzero if there are
> +                            at least N_L characters left starting at H[J].
> +                            H is 'wchar_t *', H_L, J, and N_L are 'size_t';
> +                            H_L is an lvalue.  For NUL-terminated searches,
> +                            H_L can be modified each iteration to avoid
> +                            having to compute the end of H up front.
> +
> +  For case-insensitivity, you may optionally define:
> +     CMP_FUNC(p1, p2, l)     A macro that returns 0 iff the first L
> +                            characters of P1 and P2 are equal.
> +     CANON_ELEMENT(c)        A macro that canonicalizes an element right after
> +                            it has been fetched from one of the two strings.
> +                            The argument is an 'wchar_t'; the result must
> +                            be an 'wchar_t' as well.
> +*/
> +
> +#include <limits.h>
> +#include <stdint.h>
> +#include <sys/param.h>                  /* Defines MAX.  */
> +
> +/* We use the Two-Way string matching algorithm, which guarantees
> +   linear complexity with constant space.
> +
> +   See http://www-igm.univ-mlv.fr/~lecroq/string/node26.html#SECTION00260
> +   and http://en.wikipedia.org/wiki/Boyer-Moore_string_search_algorithm
> +*/
> +
> +#ifndef CANON_ELEMENT
> +# define CANON_ELEMENT(c) c
> +#endif
> +#ifndef CMP_FUNC
> +# define CMP_FUNC __wmemcmp
> +#endif
> +
> +/* Perform a critical factorization of NEEDLE, of length NEEDLE_LEN.
> +   Return the index of the first character in the right half, and set
> +   *PERIOD to the global period of the right half.
> +
> +   The global period of a string is the smallest index (possibly its
> +   length) at which all remaining bytes in the string are repetitions
> +   of the prefix (the last repetition may be a subset of the prefix).
> +
> +   When NEEDLE is factored into two halves, a local period is the
> +   length of the smallest word that shares a suffix with the left half
> +   and shares a prefix with the right half.  All factorizations of a
> +   non-empty NEEDLE have a local period of at least 1 and no greater
> +   than NEEDLE_LEN.
> +
> +   A critical factorization has the property that the local period
> +   equals the global period.  All strings have at least one critical
> +   factorization with the left half smaller than the global period.
> +
> +   Given an ordered alphabet, a critical factorization can be computed
> +   in linear time, with 2 * NEEDLE_LEN comparisons, by computing the
> +   larger of two ordered maximal suffixes.  The ordered maximal
> +   suffixes are determined by lexicographic comparison of
> +   periodicity.  */
> +static size_t
> +critical_factorization (const wchar_t *needle, size_t needle_len,
> +                       size_t *period)
> +{
> +  /* Index of last character of left half, or SIZE_MAX.  */
> +  size_t max_suffix, max_suffix_rev;
> +  size_t j; /* Index into NEEDLE for current candidate suffix.  */
> +  size_t k; /* Offset into current period.  */
> +  size_t p; /* Intermediate period.  */
> +  wchar_t a, b; /* Current comparison bytes.  */
> +
> +  /* Special case NEEDLE_LEN of 1 or 2 (all callers already filtered
> +     out 0-length needles.  */
> +  if (needle_len < 3)
> +    {
> +      *period = 1;
> +      return needle_len - 1;
> +    }
> +
> +  /* Invariants:
> +     0 <= j < NEEDLE_LEN - 1
> +     -1 <= max_suffix{,_rev} < j (treating SIZE_MAX as if it were signed)
> +     min(max_suffix, max_suffix_rev) < global period of NEEDLE
> +     1 <= p <= global period of NEEDLE
> +     p == global period of the substring NEEDLE[max_suffix{,_rev}+1...j]
> +     1 <= k <= p
> +  */
> +
> +  /* Perform lexicographic search.  */
> +  max_suffix = SIZE_MAX;
> +  j = 0;
> +  k = p = 1;
> +  while (j + k < needle_len)
> +    {
> +      a = CANON_ELEMENT (needle[j + k]);
> +      b = CANON_ELEMENT (needle[max_suffix + k]);
> +      if (a < b)
> +       {
> +         /* Suffix is smaller, period is entire prefix so far.  */
> +         j += k;
> +         k = 1;
> +         p = j - max_suffix;
> +       }
> +      else if (a == b)
> +       {
> +         /* Advance through repetition of the current period.  */
> +         if (k != p)
> +           ++k;
> +         else
> +           {
> +             j += p;
> +             k = 1;
> +           }
> +       }
> +      else /* b < a */
> +       {
> +         /* Suffix is larger, start over from current location.  */
> +         max_suffix = j++;
> +         k = p = 1;
> +       }
> +    }
> +  *period = p;
> +
> +  /* Perform reverse lexicographic search.  */
> +  max_suffix_rev = SIZE_MAX;
> +  j = 0;
> +  k = p = 1;
> +  while (j + k < needle_len)
> +    {
> +      a = CANON_ELEMENT (needle[j + k]);
> +      b = CANON_ELEMENT (needle[max_suffix_rev + k]);
> +      if (b < a)
> +       {
> +         /* Suffix is smaller, period is entire prefix so far.  */
> +         j += k;
> +         k = 1;
> +         p = j - max_suffix_rev;
> +       }
> +      else if (a == b)
> +       {
> +         /* Advance through repetition of the current period.  */
> +         if (k != p)
> +           ++k;
> +         else
> +           {
> +             j += p;
> +             k = 1;
> +           }
> +       }
> +      else /* a < b */
> +       {
> +         /* Suffix is larger, start over from current location.  */
> +         max_suffix_rev = j++;
> +         k = p = 1;
> +       }
> +    }
> +
> +  /* Choose the shorted suffix.  Return the first character of the right
> +     half, rather than the last character of the left half.  */
> +  if (max_suffix_rev + 1 < max_suffix + 1)
> +    return max_suffix + 1;
> +  *period = p;
> +  return max_suffix_rev + 1;
> +}
> +
> +/* Return the first location of non-empty NEEDLE within HAYSTACK, or
> +   NULL.  HAYSTACK_LEN is the minimum known length of HAYSTACK.
> +
> +   If AVAILABLE does not modify HAYSTACK_LEN (as in memmem), then at
> +   most 2 * HAYSTACK_LEN - NEEDLE_LEN comparisons occur in searching.
> +   If AVAILABLE modifies HAYSTACK_LEN (as in strstr), then at most 3 *
> +   HAYSTACK_LEN - NEEDLE_LEN comparisons occur in searching.  */
> +static inline wchar_t *
> +two_way_short_needle (const wchar_t *haystack, size_t haystack_len,
> +                     const wchar_t *needle, size_t needle_len)
> +{
> +  size_t i; /* Index into current character of NEEDLE.  */
> +  size_t j; /* Index into current window of HAYSTACK.  */
> +  size_t period; /* The period of the right half of needle.  */
> +  size_t suffix; /* The index of the right half of needle.  */
> +
> +  /* Factor the needle into two halves, such that the left half is
> +     smaller than the global period, and the right half is
> +     periodic (with a period as large as NEEDLE_LEN - suffix).  */
> +  suffix = critical_factorization (needle, needle_len, &period);
> +
> +  /* Perform the search.  Each iteration compares the right half
> +     first.  */
> +  if (CMP_FUNC (needle, needle + period, suffix) == 0)
> +    {
> +      /* Entire needle is periodic; a mismatch can only advance by the
> +        period, so use memory to avoid rescanning known occurrences
> +        of the period.  */
> +      size_t memory = 0;
> +      j = 0;
> +      while (AVAILABLE (haystack, haystack_len, j, needle_len))
> +       {
> +         const wchar_t *pneedle;
> +         const wchar_t *phaystack;
> +
> +         /* Scan for matches in right half.  */
> +         i = MAX (suffix, memory);
> +         pneedle = &needle[i];
> +         phaystack = &haystack[i + j];
> +         while (i < needle_len && (CANON_ELEMENT (*pneedle++)
> +                                   == CANON_ELEMENT (*phaystack++)))
> +           ++i;
> +         if (needle_len <= i)
> +           {
> +             /* Scan for matches in left half.  */
> +             i = suffix - 1;
> +             pneedle = &needle[i];
> +             phaystack = &haystack[i + j];
> +             while (memory < i + 1 && (CANON_ELEMENT (*pneedle--)
> +                                       == CANON_ELEMENT (*phaystack--)))
> +               --i;
> +             if (i + 1 < memory + 1)
> +               return (wchar_t *) (haystack + j);
> +             /* No match, so remember how many repetitions of period
> +                on the right half were scanned.  */
> +             j += period;
> +             memory = needle_len - period;
> +           }
> +         else
> +           {
> +             j += i - suffix + 1;
> +             memory = 0;
> +           }
> +       }
> +    }
> +  else
> +    {
> +      const wchar_t *phaystack;
> +      /* The comparison always starts from needle[suffix], so cache it
> +        and use an optimized first-character loop.  */
> +      wchar_t needle_suffix = CANON_ELEMENT (needle[suffix]);
> +
> +      /* The two halves of needle are distinct; no extra memory is
> +        required, and any mismatch results in a maximal shift.  */
> +      period = MAX (suffix, needle_len - suffix) + 1;
> +      j = 0;
> +      while (AVAILABLE (haystack, haystack_len, j, needle_len))
> +       {
> +         wchar_t haystack_char;
> +         const wchar_t *pneedle;
> +
> +         phaystack = &haystack[suffix + j];
> +
> +         while (needle_suffix
> +             != (haystack_char = CANON_ELEMENT (*phaystack++)))
> +           {
> +             ++j;
> +             if (!AVAILABLE (haystack, haystack_len, j, needle_len))
> +               goto ret0;
> +           }
> +
> +         /* Scan for matches in right half.  */
> +         i = suffix + 1;
> +         pneedle = &needle[i];
> +         while (i < needle_len)
> +           {
> +             if (CANON_ELEMENT (*pneedle++)
> +                 != (haystack_char = CANON_ELEMENT (*phaystack++)))
> +               break;
> +             ++i;
> +           }
> +         if (needle_len <= i)
> +           {
> +             /* Scan for matches in left half.  */
> +             i = suffix - 1;
> +             pneedle = &needle[i];
> +             phaystack = &haystack[i + j];
> +             while (i != SIZE_MAX)
> +               {
> +                 if (CANON_ELEMENT (*pneedle--)
> +                     != (haystack_char = CANON_ELEMENT (*phaystack--)))
> +                   break;
> +                 --i;
> +               }
> +             if (i == SIZE_MAX)
> +               return (wchar_t *) (haystack + j);
> +             j += period;
> +           }
> +         else
> +           j += i - suffix + 1;
> +       }
> +    }
> +ret0: __attribute__ ((unused))
> +  return NULL;
> +}
> +
> +#undef AVAILABLE
> +#undef CANON_ELEMENT
> +#undef CMP_FUNC
> diff --git a/wcsmbs/wcsstr.c b/wcsmbs/wcsstr.c
> index 78f1cc9ce0..7e791a5356 100644
> --- a/wcsmbs/wcsstr.c
> +++ b/wcsmbs/wcsstr.c
> @@ -1,4 +1,5 @@
> -/* Copyright (C) 1995-2024 Free Software Foundation, Inc.
> +/* Locate a substring in a wide-character string.
> +   Copyright (C) 1995-2024 Free Software Foundation, Inc.
>     This file is part of the GNU C Library.
>
>     The GNU C Library is free software; you can redistribute it and/or
> @@ -15,82 +16,41 @@
>     License along with the GNU C Library; if not, see
>     <https://www.gnu.org/licenses/>.  */
>
> -/*
> - * The original strstr() file contains the following comment:
> - *
> - * My personal strstr() implementation that beats most other algorithms.
> - * Until someone tells me otherwise, I assume that this is the
> - * fastest implementation of strstr() in C.
> - * I deliberately chose not to comment it.  You should have at least
> - * as much fun trying to understand it, as I had to write it :-).
> - *
> - * Stephen R. van den Berg, berg@pool.informatik.rwth-aachen.de */
> -
>  #include <wchar.h>
> +#include <string.h>
> +
> +#define AVAILABLE(h, h_l, j, n_l)                              \
> +  (((j) + (n_l) <= (h_l))                                      \
> +   || ((h_l) += __wcsnlen ((void*)((h) + (h_l)), (n_l) + 128), \
> +       (j) + (n_l) <= (h_l)))
> +#include "wcs-two-way.h"
> +
> +/* Hash character pairs so a small shift table can be used.  All bits of
> +   p[0] are included, but not all bits from p[-1].  So if two equal hashes
> +   match on p[-1], p[0] matches too.  Hash collisions are harmless and result
> +   in smaller shifts.  */
> +#define hash2(p) (((size_t)(p)[0] - ((size_t)(p)[-1] << 3)) % sizeof (shift))
>
>  wchar_t *
>  wcsstr (const wchar_t *haystack, const wchar_t *needle)
>  {
any issue with just doing?
```
memmem(haystack, sizeof(wchar_t) * wcslen(haystack), needle,
sizeof(wchar_t) * wcslen(needle))
```
> -  wchar_t b, c;
> -
> -  if ((b = *needle) != L'\0')
> -    {
> -      haystack--;                              /* possible ANSI violation */
> -      do
> -       if ((c = *++haystack) == L'\0')
> -         goto ret0;
> -      while (c != b);
> -
> -      if (!(c = *++needle))
> -       goto foundneedle;
> -      ++needle;
> -      goto jin;
> -
> -      for (;;)
> -       {
> -         wchar_t a;
> -         const wchar_t *rhaystack, *rneedle;
> -
> -         do
> -           {
> -             if (!(a = *++haystack))
> -               goto ret0;
> -             if (a == b)
> -               break;
> -             if ((a = *++haystack) == L'\0')
> -               goto ret0;
> -shloop:              ;
> -           }
> -         while (a != b);
> -
> -jin:     if (!(a = *++haystack))
> -           goto ret0;
> -
> -         if (a != c)
> -           goto shloop;
> -
> -         if (*(rhaystack = haystack-- + 1) == (a = *(rneedle = needle)))
> -           do
> -             {
> -               if (a == L'\0')
> -                 goto foundneedle;
> -               if (*++rhaystack != (a = *++needle))
> -                 break;
> -               if (a == L'\0')
> -                 goto foundneedle;
> -             }
> -           while (*++rhaystack == (a = *++needle));
> -
> -         needle = rneedle;               /* took the register-poor approach */
> -
> -         if (a == L'\0')
> -           break;
> -       }
> -    }
> -foundneedle:
> -  return (wchar_t*) haystack;
> -ret0:
> -  return NULL;
> +  const wchar_t *hs = (const wchar_t *) haystack;
> +  const wchar_t *ne = (const wchar_t *) needle;
> +
> +  /* Ensure haystack length is at least as long as needle length.
> +     Since a match may occur early on in a huge haystack, use strnlen
> +     and read ahead a few cachelines for improved performance.  */
> +  size_t ne_len = __wcslen (ne);
> +  size_t hs_len = __wcsnlen (hs, ne_len | 128);
> +  if (hs_len < ne_len)
> +    return NULL;
> +
> +  /* Check whether we have a match.  This improves performance since we
> +     avoid initialization overheads.  */
> +  if (__wmemcmp (hs, ne, ne_len) == 0)
> +    return (wchar_t *) hs;
> +
> +  return two_way_short_needle (hs, hs_len, ne, ne_len);
>  }
>  /* This alias is for backward compatibility with drafts of the ISO C
>     standard.  Unfortunately the Unix(TM) standard requires this name.  */
> --
> 2.34.1
>

On 19/02/24 21:15, Noah Goldstein wrote:
> On Mon, Feb 19, 2024 at 8:45 PM Adhemerval Zanella
> <adhemerval.zanella@linaro.org> wrote:

>> +
>> +/* Hash character pairs so a small shift table can be used.  All bits of
>> +   p[0] are included, but not all bits from p[-1].  So if two equal hashes
>> +   match on p[-1], p[0] matches too.  Hash collisions are harmless and result
>> +   in smaller shifts.  */
>> +#define hash2(p) (((size_t)(p)[0] - ((size_t)(p)[-1] << 3)) % sizeof (shift))
>>
>>  wchar_t *
>>  wcsstr (const wchar_t *haystack, const wchar_t *needle)
>>  {
> any issue with just doing?
> ```
> memmem(haystack, sizeof(wchar_t) * wcslen(haystack), needle,
> sizeof(wchar_t) * wcslen(needle))
> ```

None at all, in fact this is a better simplification.  I will update the
patch.

On Tue, 20 Feb 2024, Adhemerval Zanella Netto wrote:

> >>  wchar_t *
> >>  wcsstr (const wchar_t *haystack, const wchar_t *needle)
> >>  {
> > any issue with just doing?
> > ```
> > memmem(haystack, sizeof(wchar_t) * wcslen(haystack), needle,
> > sizeof(wchar_t) * wcslen(needle))
> > ```
> 
> None at all, in fact this is a better simplification.  I will update the
> patch.

What guarantees that memmem is not going to return a pointer
into the middle of a wide char?

(neither does strstr defer to memmem, avoiding strlen(haystack)
when there's an early match)

Alexander

On 20/02/24 10:01, Alexander Monakov wrote:
> 
> On Tue, 20 Feb 2024, Adhemerval Zanella Netto wrote:
> 
>>>>  wchar_t *
>>>>  wcsstr (const wchar_t *haystack, const wchar_t *needle)
>>>>  {
>>> any issue with just doing?
>>> ```
>>> memmem(haystack, sizeof(wchar_t) * wcslen(haystack), needle,
>>> sizeof(wchar_t) * wcslen(needle))
>>> ```
>>
>> None at all, in fact this is a better simplification.  I will update the
>> patch.
> 
> What guarantees that memmem is not going to return a pointer
> into the middle of a wide char?
> 
> (neither does strstr defer to memmem, avoiding strlen(haystack)
> when there's an early match)

My understanding is the interface should be composable since memmem
should be agnostic to the input, although it might not have the best 
performance (which I really don't care for wcsstr, the idea is just to 
remove the quadratic behavior).  Do you have an example where it would 
fail?

On Tue, Feb 20, 2024 at 1:16 PM Adhemerval Zanella Netto
<adhemerval.zanella@linaro.org> wrote:
>
>
>
> On 20/02/24 10:01, Alexander Monakov wrote:
> >
> > On Tue, 20 Feb 2024, Adhemerval Zanella Netto wrote:
> >
> >>>>  wchar_t *
> >>>>  wcsstr (const wchar_t *haystack, const wchar_t *needle)
> >>>>  {
> >>> any issue with just doing?
> >>> ```
> >>> memmem(haystack, sizeof(wchar_t) * wcslen(haystack), needle,
> >>> sizeof(wchar_t) * wcslen(needle))
> >>> ```
> >>
> >> None at all, in fact this is a better simplification.  I will update the
> >> patch.
> >
> > What guarantees that memmem is not going to return a pointer
> > into the middle of a wide char?
> >
> > (neither does strstr defer to memmem, avoiding strlen(haystack)
> > when there's an early match)
>
> My understanding is the interface should be composable since memmem
> should be agnostic to the input, although it might not have the best
> performance (which I really don't care for wcsstr, the idea is just to
> remove the quadratic behavior).  Do you have an example where it would
> fail?

Think its a valid issue. Something like:

```
hay = {0x4030201, 0x8070605, 0x0};
nee = {0x6050403, 0x0};
```

Would match a midpoint of 2nd char of hay.

Could probably loop through `memem` and if the result is not aligned to
sizeof(wchar_t), continue from the next byte position.

On 20/02/24 13:07, Noah Goldstein wrote:
> On Tue, Feb 20, 2024 at 1:16 PM Adhemerval Zanella Netto
> <adhemerval.zanella@linaro.org> wrote:
>>
>>
>>
>> On 20/02/24 10:01, Alexander Monakov wrote:
>>>
>>> On Tue, 20 Feb 2024, Adhemerval Zanella Netto wrote:
>>>
>>>>>>  wchar_t *
>>>>>>  wcsstr (const wchar_t *haystack, const wchar_t *needle)
>>>>>>  {
>>>>> any issue with just doing?
>>>>> ```
>>>>> memmem(haystack, sizeof(wchar_t) * wcslen(haystack), needle,
>>>>> sizeof(wchar_t) * wcslen(needle))
>>>>> ```
>>>>
>>>> None at all, in fact this is a better simplification.  I will update the
>>>> patch.
>>>
>>> What guarantees that memmem is not going to return a pointer
>>> into the middle of a wide char?
>>>
>>> (neither does strstr defer to memmem, avoiding strlen(haystack)
>>> when there's an early match)
>>
>> My understanding is the interface should be composable since memmem
>> should be agnostic to the input, although it might not have the best
>> performance (which I really don't care for wcsstr, the idea is just to
>> remove the quadratic behavior).  Do you have an example where it would
>> fail?
> 
> Think its a valid issue. Something like:
> 
> ```
> hay = {0x4030201, 0x8070605, 0x0};
> nee = {0x6050403, 0x0};
> ```
> 
> Would match a midpoint of 2nd char of hay.
> 
> Could probably loop through `memem` and if the result is not aligned to
> sizeof(wchar_t), continue from the next byte position.

Right, I realized that we are not memmem for the final null wide byes.
I will add such tests and I think it would be better to use the initial
two_way_short_needle strategy that assures it uses wide chars.