[pcre-dev] [Bug 2126] Segfault due to stack overflow for lon…

Top Page

Reply to this message
Author: admin
Date:  
To: pcre-dev
Old-Topics: [pcre-dev] [Bug 2126] New: Segfault due to stack overflow for long strings matching a recursive regex
Subject: [pcre-dev] [Bug 2126] Segfault due to stack overflow for long strings matching a recursive regex
https://bugs.exim.org/show_bug.cgi?id=2126

Mehmet gelisin <mehmetgelisin@???> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mehmetgelisin@???


--- Comment #3 from Mehmet gelisin <mehmetgelisin@???> ---
This bug was previously discussed with the gnu grep project and we concluded
that it is really an issue with pcre. Although I initially found the problem
with grep, Norihiro Tanaka from the gnu grep project managed to reproduce it
using only pcre-8.36 (Fedora21, RHEL 6.5). His findings are subsequently
reproduced by Paul Eggert (gnu grep; CentOS 6.5 x86-64) and myself (Ubuntu
14.04 x64_64). http://www.compilatori.com/

Notes from Norihiro: By the way, if we enabled to optimize or recompile pcre
with --enable-jit option, it did not reproduced.

How to reproduce:

== Norihiro's code ==
#include <stdio.h>
#include <stdlib.h>
#include <string.h> http://www.acpirateradio.co.uk/
#include <pcre.h>

enum { LEN = 15000 };
enum { NSUB = 300 };

int
main () http://www.logoarts.co.uk/
{
char *text = malloc ((LEN + 1) * sizeof *text);
memset (text, '0', LEN);
text[LEN] = '\0';
char const *re = "0(?:(?!foo).)+";
char const *ep;
int eo;

  pcre *cre = pcre_compile (re, 0, &ep, &eo, NULL);
  if (!cre)
    exit (EXIT_FAILURE); http://www.slipstone.co.uk/


int sub[NSUB];
pcre_exec (cre, NULL, text, strlen (text), 0, 0, sub, NSUB);

exit (EXIT_SUCCESS);
}
== http://embermanchester.uk/

Steps I followed to reproduce:

€ tar xzf pcre-8.36.tar.gz
€ cd pcre-8.36
€ CFLAGS=-g ./configure --enable-utf --enable-unicode-properties
--prefix=/tmp/segfaultGrep
€ make
€ make install http://connstr.net/

€ gcc reproduce.c -L/tmp/segfaultGrep/lib -lpcre
€ LD_LIBRARY_PATH=/tmp/segfaultGrep/lib ./a.out; echo $?
Segmentation fault (core dumped)

This bug was previously discussed with the gnu grep project and we concluded
that it is really an issue with pcre. Although I initially found the problem
with grep, Norihiro Tanaka from the gnu grep project managed to reproduce it
using only pcre-8.36 (Fedora21, RHEL 6.5). His findings are subsequently
reproduced by Paul Eggert (gnu grep; CentOS 6.5 x86-64) and myself (Ubuntu
14.04 x64_64).
http://joerg.li/
Notes from Norihiro: By the way, if we enabled to optimize or recompile pcre
with --enable-jit option, it did not reproduced.

How to reproduce:
http://www.jopspeech.com/
== Norihiro's code ==
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <pcre.h>

enum { LEN = 15000 }; http://www.wearelondonmade.com/
enum { NSUB = 300 };

int
main ()
{
char *text = malloc ((LEN + 1) * sizeof *text);
memset (text, '0', LEN);
text[LEN] = '\0';
char const *re = "0(?:(?!foo).)+";
char const *ep;
int eo;

  pcre *cre = pcre_compile (re, 0, &ep, &eo, NULL);
  if (!cre)
    exit (EXIT_FAILURE);
https://waytowhatsnext.com/
  int sub[NSUB];
  pcre_exec (cre, NULL, text, strlen (text), 0, 0, sub, NSUB);


exit (EXIT_SUCCESS);
}
==
https://www.webb-dev.co.uk/
Steps I followed to reproduce:

€ tar xzf pcre-8.36.tar.gz
€ cd pcre-8.36
€ CFLAGS=-g ./configure --enable-utf --enable-unicode-properties
--prefix=/tmp/segfaultGrep http://www.iu-bloomington.com/
€ make
€ make install

€ gcc reproduce.c -L/tmp/segfaultGrep/lib -lpcre
€ LD_LIBRARY_PATH=/tmp/segfaultGrep/lib ./a.out; echo $? http://www-look-4.com/
Segmentation fault (core dumped)

--
You are receiving this mail because:
You are on the CC list for the bug.