Revision: 1761
http://vcs.pcre.org/viewvc?view=rev&revision=1761
Author: ph10
Date: 2020-02-10 17:17:34 +0000 (Mon, 10 Feb 2020)
Log Message:
-----------
Check the size of the number after (?C as it is read, in order to avoid integer
overflow.
Modified Paths:
--------------
code/trunk/ChangeLog
code/trunk/pcre_compile.c
Modified: code/trunk/ChangeLog
===================================================================
--- code/trunk/ChangeLog 2020-02-10 17:01:27 UTC (rev 1760)
+++ code/trunk/ChangeLog 2020-02-10 17:17:34 UTC (rev 1761)
@@ -27,7 +27,10 @@
after a successful compile, instead of at the start of matching to avoid a
sanitizer complaint (regexec is supposed to be thread safe).
+6. Check the size of the number after (?C as it is read, in order to avoid
+integer overflow.
+
Version 8.43 23-February-2019
-----------------------------
Modified: code/trunk/pcre_compile.c
===================================================================
--- code/trunk/pcre_compile.c 2020-02-10 17:01:27 UTC (rev 1760)
+++ code/trunk/pcre_compile.c 2020-02-10 17:17:34 UTC (rev 1761)
@@ -6,7 +6,7 @@
and semantics are as close as possible to those of the Perl 5 language.
Written by Philip Hazel
- Copyright (c) 1997-2018 University of Cambridge
+ Copyright (c) 1997-2020 University of Cambridge
-----------------------------------------------------------------------------
Redistribution and use in source and binary forms, with or without
@@ -7130,17 +7130,19 @@
int n = 0;
ptr++;
while(IS_DIGIT(*ptr))
+ {
n = n * 10 + *ptr++ - CHAR_0;
+ if (n > 255)
+ {
+ *errorcodeptr = ERR38;
+ goto FAILED;
+ }
+ }
if (*ptr != CHAR_RIGHT_PARENTHESIS)
{
*errorcodeptr = ERR39;
goto FAILED;
}
- if (n > 255)
- {
- *errorcodeptr = ERR38;
- goto FAILED;
- }
*code++ = n;
PUT(code, 0, (int)(ptr - cd->start_pattern + 1)); /* Pattern offset */
PUT(code, LINK_SIZE, 0); /* Default length */
