[pcre-dev] [Bug 2479] Heap buffer overflow vulnerability in …

Top Page
Delete this message
Author: admin
Date:  
To: pcre-dev
Subject: [pcre-dev] [Bug 2479] Heap buffer overflow vulnerability in GETCHARINC() (pcre2_match.c)
https://bugs.exim.org/show_bug.cgi?id=2479

--- Comment #3 from clickwithsk@??? ---
(In reply to Philip Hazel from comment #2)
> Your test file does not fail for me. I get a pile of error messages, ending
> with
> ** Binary zero encountered in input
> ** pcre2test run abandoned
>
> However, I see that \=no_utf_check occurs in several places in the file. I
> suspect you are passing invalid UTF with this option set. If so, you can
> expect crashes. This is documented. Turning off the UTF checking should only
> be done if you know that the input is a valid UTF string.


The test file fails only when compiled with ASAN. I found the crash using
fuzzer.
The input uses \=no_utf_check.

I read the documentation. For clarification, should the input be validated by
the user to avoid such cases (i.e., turning off the UTF checking only if the
input is a valid UTF string)?

--
You are receiving this mail because:
You are on the CC list for the bug.