From b72f69c0d45947e703543c5ff039a36d3edf5e84 Mon Sep 17 00:00:00 2001

From: Ray Strode <rstrode@redhat.com>

Date: Tue, 26 Mar 2019 11:03:00 -0400

Subject: [PATCH] gsm-util: avoid groups in regexex

They can lead to stack overflows if pcre isn't built with --disable-stack-for-recursion

---

 gnome-session/gsm-util.c | 4 ++--

 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnome-session/gsm-util.c b/gnome-session/gsm-util.c

index acb446a3..be971fe1 100644

--- a/gnome-session/gsm-util.c

+++ b/gnome-session/gsm-util.c

@@ -490,61 +490,61 @@ gsm_util_update_activation_environment (const char  *variable,

         g_clear_object (&connection);

         return environment_updated;

 }

 gboolean

 gsm_util_export_activation_environment (GError     **error)

 {

         GDBusConnection *connection;

         gboolean         environment_updated = FALSE;

         char           **entry_names;

         int              i = 0;

         GVariantBuilder  builder;

         GRegex          *name_regex, *value_regex;

         GVariant        *reply;

         GError          *bus_error = NULL;

         connection = g_bus_get_sync (G_BUS_TYPE_SESSION, NULL, error);

         if (connection == NULL) {

                 return FALSE;

         }

         name_regex = g_regex_new ("^[a-zA-Z_][a-zA-Z0-9_]*$", G_REGEX_OPTIMIZE, 0, error);

         if (name_regex == NULL) {

                 return FALSE;

         }

-        value_regex = g_regex_new ("^([[:blank:]]|[^[:cntrl:]])*$", G_REGEX_OPTIMIZE, 0, error);

+        value_regex = g_regex_new ("^[[:blank:][:^cntrl:]]*$", G_REGEX_OPTIMIZE, 0, error);

         if (value_regex == NULL) {

                 return FALSE;

         }

         g_variant_builder_init (&builder, G_VARIANT_TYPE ("a{ss}"));

         for (entry_names = g_listenv (); entry_names[i] != NULL; i++) {

                 const char *entry_name = entry_names[i];

                 const char *entry_value = g_getenv (entry_name);

                 if (!g_utf8_validate (entry_name, -1, NULL))

                     continue;

                 if (!g_regex_match (name_regex, entry_name, 0, NULL))

                     continue;

                 if (!g_utf8_validate (entry_value, -1, NULL))

                     continue;

                 if (!g_regex_match (value_regex, entry_value, 0, NULL))

                     continue;

                 g_variant_builder_add (&builder, "{ss}", entry_name, entry_value);

         }

         g_regex_unref (name_regex);

         g_regex_unref (value_regex);

         g_strfreev (entry_names);

         reply = g_dbus_connection_call_sync (connection,

@@ -563,61 +563,61 @@ gsm_util_export_activation_environment (GError     **error)

         } else {

                 environment_updated = TRUE;

                 g_variant_unref (reply);

         }

         g_clear_object (&connection);

         return environment_updated;

 }

 #ifdef HAVE_SYSTEMD

 gboolean

 gsm_util_export_user_environment (GError     **error)

 {

         GDBusConnection *connection;

         gboolean         environment_updated = FALSE;

         char           **entries;

         int              i = 0;

         GVariantBuilder  builder;

         GRegex          *regex;

         GVariant        *reply;

         GError          *bus_error = NULL;

         connection = g_bus_get_sync (G_BUS_TYPE_SESSION, NULL, error);

         if (connection == NULL) {

                 return FALSE;

         }

-        regex = g_regex_new ("^[a-zA-Z_][a-zA-Z0-9_]*=([[:blank:]]|[^[:cntrl:]])*$", G_REGEX_OPTIMIZE, 0, error);

+        regex = g_regex_new ("^[a-zA-Z_][a-zA-Z0-9_]*=[[:blank:][:^cntrl:]]*$", G_REGEX_OPTIMIZE, 0, error);

         if (regex == NULL) {

                 return FALSE;

         }

         g_variant_builder_init (&builder, G_VARIANT_TYPE ("as"));

         for (entries = g_get_environ (); entries[i] != NULL; i++) {

                 const char *entry = entries[i];

                 if (!g_utf8_validate (entry, -1, NULL))

                     continue;

                 if (!g_regex_match (regex, entry, 0, NULL))

                     continue;

                 g_variant_builder_add (&builder, "s", entry);

         }

         g_regex_unref (regex);

         g_strfreev (entries);

         reply = g_dbus_connection_call_sync (connection,

                                              "org.freedesktop.systemd1",

                                              "/org/freedesktop/systemd1",

                                              "org.freedesktop.systemd1.Manager",

                                              "SetEnvironment",

                                              g_variant_new ("(@as)",

                                                             g_variant_builder_end (&builder)),

                                              NULL,

                                              G_DBUS_CALL_FLAGS_NONE,

-- 

2.20.1