Revision: 1591
http://vcs.pcre.org/viewvc?view=rev&revision=1591
Author: zherczeg
Date: 2015-08-11 06:41:09 +0100 (Tue, 11 Aug 2015)
Log Message:
-----------
The JIT compiler should not check repeats after a {0,1} repeat byte code.
Modified Paths:
--------------
code/trunk/ChangeLog
code/trunk/pcre_jit_compile.c
code/trunk/testdata/testinput2
code/trunk/testdata/testoutput2
Modified: code/trunk/ChangeLog
===================================================================
--- code/trunk/ChangeLog 2015-08-10 14:38:34 UTC (rev 1590)
+++ code/trunk/ChangeLog 2015-08-11 05:41:09 UTC (rev 1591)
@@ -126,7 +126,10 @@
It has been re-written for PCRE2. Here in PCRE1, a check has been added to
give an internal error if it is obvious that compiling has gone wrong.
+33. The JIT compiler should not check repeats after a {0,1} repeat byte code.
+ This issue was found by Karl Skomski with a custom LLVM fuzzer.
+
Version 8.37 28-April-2015
--------------------------
Modified: code/trunk/pcre_jit_compile.c
===================================================================
--- code/trunk/pcre_jit_compile.c 2015-08-10 14:38:34 UTC (rev 1590)
+++ code/trunk/pcre_jit_compile.c 2015-08-11 05:41:09 UTC (rev 1591)
@@ -1064,6 +1064,7 @@
pcre_uchar *end = NULL;
int private_data_ptr = *private_data_start;
int space, size, bracketlen;
+BOOL repeat_check = TRUE;
while (cc < ccend)
{
@@ -1073,7 +1074,8 @@
if (private_data_ptr > SLJIT_MAX_LOCAL_SIZE)
break;
- if (*cc == OP_ONCE || *cc == OP_ONCE_NC || *cc == OP_BRA || *cc == OP_CBRA || *cc == OP_COND)
+ if (repeat_check && (*cc == OP_ONCE || *cc == OP_ONCE_NC || *cc == OP_BRA || *cc == OP_CBRA || *cc == OP_COND))
+ {
if (detect_repeat(common, cc))
{
/* These brackets are converted to repeats, so no global
@@ -1081,6 +1083,8 @@
if (cc >= end)
end = bracketend(cc);
}
+ }
+ repeat_check = TRUE;
switch(*cc)
{
@@ -1136,6 +1140,13 @@
bracketlen = 1 + LINK_SIZE + IMM2_SIZE;
break;
+ case OP_BRAZERO:
+ case OP_BRAMINZERO:
+ case OP_BRAPOSZERO:
+ repeat_check = FALSE;
+ size = 1;
+ break;
+
CASE_ITERATOR_PRIVATE_DATA_1
space = 1;
size = -2;
Modified: code/trunk/testdata/testinput2
===================================================================
--- code/trunk/testdata/testinput2 2015-08-10 14:38:34 UTC (rev 1590)
+++ code/trunk/testdata/testinput2 2015-08-11 05:41:09 UTC (rev 1591)
@@ -4203,4 +4203,6 @@
/(?(8000000000/
+/(?:ab)?(?:ab)(?:ab)/
+
/-- End of testinput2 --/
Modified: code/trunk/testdata/testoutput2
===================================================================
--- code/trunk/testdata/testoutput2 2015-08-10 14:38:34 UTC (rev 1590)
+++ code/trunk/testdata/testoutput2 2015-08-11 05:41:09 UTC (rev 1591)
@@ -14549,4 +14549,6 @@
/(?(8000000000/
Failed: number is too big at offset 13
+/(?:ab)?(?:ab)(?:ab)/
+
/-- End of testinput2 --/
