Revision: 281
http://www.exim.org/viewvc/pcre2?view=rev&revision=281
Author: ph10
Date: 2015-06-08 18:51:54 +0100 (Mon, 08 Jun 2015)
Log Message:
-----------
Check for integer overflow in subroutine calls.
Modified Paths:
--------------
code/trunk/ChangeLog
code/trunk/src/pcre2_compile.c
code/trunk/testdata/testinput2
code/trunk/testdata/testoutput2
Modified: code/trunk/ChangeLog
===================================================================
--- code/trunk/ChangeLog 2015-06-03 17:18:06 UTC (rev 280)
+++ code/trunk/ChangeLog 2015-06-08 17:51:54 UTC (rev 281)
@@ -146,7 +146,9 @@
computing the memory requirements for some patterns, leading to buffer
overflows.
+37. There was no check for integer overflow in subroutine calls such as (?123).
+
Version 10.10 06-March-2015
---------------------------
Modified: code/trunk/src/pcre2_compile.c
===================================================================
--- code/trunk/src/pcre2_compile.c 2015-06-03 17:18:06 UTC (rev 280)
+++ code/trunk/src/pcre2_compile.c 2015-06-08 17:51:54 UTC (rev 281)
@@ -6483,8 +6483,16 @@
}
recno = 0;
- while(IS_DIGIT(*ptr))
+ while (IS_DIGIT(*ptr))
+ {
+ if (recno > INT_MAX / 10 - 1) /* Integer overflow */
+ {
+ while (IS_DIGIT(*ptr)) ptr++;
+ *errorcodeptr = ERR61;
+ goto FAILED;
+ }
recno = recno * 10 + *ptr++ - CHAR_0;
+ }
if (*ptr != (PCRE2_UCHAR)terminator)
{
Modified: code/trunk/testdata/testinput2
===================================================================
--- code/trunk/testdata/testinput2 2015-06-03 17:18:06 UTC (rev 280)
+++ code/trunk/testdata/testinput2 2015-06-08 17:51:54 UTC (rev 281)
@@ -4323,4 +4323,6 @@
"(?J:(?|(?'R')(\k'R')|((?'R'))))"
+/(?<=|(\,\$(?73591620449005828816)\xa8.{7}){6}\x09)/
+
# End of testinput2
Modified: code/trunk/testdata/testoutput2
===================================================================
--- code/trunk/testdata/testoutput2 2015-06-03 17:18:06 UTC (rev 280)
+++ code/trunk/testdata/testoutput2 2015-06-08 17:51:54 UTC (rev 281)
@@ -14449,4 +14449,7 @@
"(?J:(?|(?'R')(\k'R')|((?'R'))))"
+/(?<=|(\,\$(?73591620449005828816)\xa8.{7}){6}\x09)/
+Failed: error 161 at offset 32: number is too big
+
# End of testinput2
