|
 |
cb67f2 |
From 7a8c5efada4bd9e9b625b041184299d4aff06bd5 Mon Sep 17 00:00:00 2001
|
|
|
cb67f2 |
From: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
|
|
|
cb67f2 |
Date: Sun, 8 Feb 2015 16:43:13 +0000
|
|
|
cb67f2 |
Subject: [PATCH 1/3] Fix duplicate names memory calculation error.
|
|
|
cb67f2 |
MIME-Version: 1.0
|
|
|
cb67f2 |
Content-Type: text/plain; charset=UTF-8
|
|
|
cb67f2 |
Content-Transfer-Encoding: 8bit
|
|
|
cb67f2 |
|
|
|
cb67f2 |
Ported to 8.32:
|
|
|
cb67f2 |
|
|
|
cb67f2 |
commit 46465068f53358d3ae6cca4d9db8d1ed3b9f1928
|
|
|
cb67f2 |
Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
|
|
|
cb67f2 |
Date: Sun Feb 8 16:43:13 2015 +0000
|
|
|
cb67f2 |
|
|
|
cb67f2 |
Fix duplicate names memory calculation error.
|
|
|
cb67f2 |
|
|
|
cb67f2 |
git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1521 2f5784b3-3f2a-0410-8824-cb99058d5e15
|
|
|
cb67f2 |
|
|
|
cb67f2 |
Signed-off-by: Petr Písař <ppisar@redhat.com>
|
|
|
cb67f2 |
|
|
|
cb67f2 |
XXX: Complete fix requires:
|
|
|
cb67f2 |
|
|
|
cb67f2 |
commit b9a4e4087ac610792118c6dc7c8e83ab313da1ed
|
|
|
cb67f2 |
Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
|
|
|
cb67f2 |
Date: Tue Sep 3 10:10:59 2013 +0000
|
|
|
cb67f2 |
|
|
|
cb67f2 |
Refactor the code for creating the name/number table.
|
|
|
cb67f2 |
|
|
|
cb67f2 |
git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1359 2f5784b3-3f2a-0410-8824-
|
|
|
cb67f2 |
cb99058d5e15
|
|
|
cb67f2 |
|
|
|
cb67f2 |
Otherwise the CVE-2015-8385 is fixed by `Fix buffer overflow for named
|
|
|
cb67f2 |
references in (?| situations' patch.
|
|
|
cb67f2 |
|
|
|
cb67f2 |
Signed-off-by: Petr Písař <ppisar@redhat.com>
|
|
|
cb67f2 |
---
|
|
|
cb67f2 |
pcre_compile.c | 6 ++++++
|
|
|
cb67f2 |
testdata/testinput2 | 2 ++
|
|
|
cb67f2 |
testdata/testoutput11-16 | 2 +-
|
|
|
cb67f2 |
testdata/testoutput11-32 | 2 +-
|
|
|
cb67f2 |
testdata/testoutput11-8 | 2 +-
|
|
|
cb67f2 |
testdata/testoutput2 | 2 ++
|
|
|
cb67f2 |
6 files changed, 13 insertions(+), 3 deletions(-)
|
|
|
cb67f2 |
|
|
|
cb67f2 |
diff --git a/pcre_compile.c b/pcre_compile.c
|
|
|
cb67f2 |
index 86cd0c8..4506e56 100644
|
|
|
cb67f2 |
--- a/pcre_compile.c
|
|
|
cb67f2 |
+++ b/pcre_compile.c
|
|
|
cb67f2 |
@@ -6294,6 +6294,12 @@ for (;; ptr++)
|
|
|
cb67f2 |
(options & PCRE_EXTENDED) != 0, utf);
|
|
|
cb67f2 |
cd->end_pattern = temp;
|
|
|
cb67f2 |
if (recno < 0) recno = 0; /* Forward ref; set dummy number */
|
|
|
cb67f2 |
+
|
|
|
cb67f2 |
+ /* We have to allow for a named reference to a duplicated name (this
|
|
|
cb67f2 |
+ cannot be determined until the second pass). This needs an extra
|
|
|
cb67f2 |
+ 16-bit data item. */
|
|
|
cb67f2 |
+
|
|
|
cb67f2 |
+ *lengthptr += IMM2_SIZE;
|
|
|
cb67f2 |
}
|
|
|
cb67f2 |
|
|
|
cb67f2 |
/* In the real compile, seek the name in the table. We check the name
|
|
|
cb67f2 |
diff --git a/testdata/testinput2 b/testdata/testinput2
|
|
|
cb67f2 |
index e6d0e87..53c4718 100644
|
|
|
cb67f2 |
--- a/testdata/testinput2
|
|
|
cb67f2 |
+++ b/testdata/testinput2
|
|
|
cb67f2 |
@@ -3818,4 +3818,6 @@ settings of the anchored and startline bits. --/
|
|
|
cb67f2 |
|
|
|
cb67f2 |
/(((a\2)|(a*)\g<-1>))*a?/BZ
|
|
|
cb67f2 |
|
|
|
cb67f2 |
+/(?<N111>(?J)(?<N111>1(111111)11|)1|1|)(?(<N111>)1)/
|
|
|
cb67f2 |
+
|
|
|
cb67f2 |
/-- End of testinput2 --/
|
|
|
cb67f2 |
diff --git a/testdata/testoutput11-16 b/testdata/testoutput11-16
|
|
|
cb67f2 |
index de64e37..4115877 100644
|
|
|
cb67f2 |
--- a/testdata/testoutput11-16
|
|
|
cb67f2 |
+++ b/testdata/testoutput11-16
|
|
|
cb67f2 |
@@ -232,7 +232,7 @@ Memory allocation (code space): 73
|
|
|
cb67f2 |
------------------------------------------------------------------
|
|
|
cb67f2 |
|
|
|
cb67f2 |
/(?Pa)...(?P=a)bbb(?P>a)d/BM
|
|
|
cb67f2 |
-Memory allocation (code space): 57
|
|
|
cb67f2 |
+Memory allocation (code space): 61
|
|
|
cb67f2 |
------------------------------------------------------------------
|
|
|
cb67f2 |
0 24 Bra
|
|
|
cb67f2 |
2 5 CBra 1
|
|
|
cb67f2 |
diff --git a/testdata/testoutput11-32 b/testdata/testoutput11-32
|
|
|
cb67f2 |
index 0d32e2f..3f66acd 100644
|
|
|
cb67f2 |
--- a/testdata/testoutput11-32
|
|
|
cb67f2 |
+++ b/testdata/testoutput11-32
|
|
|
cb67f2 |
@@ -232,7 +232,7 @@ Memory allocation (code space): 155
|
|
|
cb67f2 |
------------------------------------------------------------------
|
|
|
cb67f2 |
|
|
|
cb67f2 |
/(?Pa)...(?P=a)bbb(?P>a)d/BM
|
|
|
cb67f2 |
-Memory allocation (code space): 117
|
|
|
cb67f2 |
+Memory allocation (code space): 125
|
|
|
cb67f2 |
------------------------------------------------------------------
|
|
|
cb67f2 |
0 24 Bra
|
|
|
cb67f2 |
2 5 CBra 1
|
|
|
cb67f2 |
diff --git a/testdata/testoutput11-8 b/testdata/testoutput11-8
|
|
|
cb67f2 |
index 9447fb6..27e2c65 100644
|
|
|
cb67f2 |
--- a/testdata/testoutput11-8
|
|
|
cb67f2 |
+++ b/testdata/testoutput11-8
|
|
|
cb67f2 |
@@ -232,7 +232,7 @@ Memory allocation (code space): 45
|
|
|
cb67f2 |
------------------------------------------------------------------
|
|
|
cb67f2 |
|
|
|
cb67f2 |
/(?Pa)...(?P=a)bbb(?P>a)d/BM
|
|
|
cb67f2 |
-Memory allocation (code space): 34
|
|
|
cb67f2 |
+Memory allocation (code space): 38
|
|
|
cb67f2 |
------------------------------------------------------------------
|
|
|
cb67f2 |
0 30 Bra
|
|
|
cb67f2 |
3 7 CBra 1
|
|
|
cb67f2 |
diff --git a/testdata/testoutput2 b/testdata/testoutput2
|
|
|
cb67f2 |
index 2a2b577..b0b46d7 100644
|
|
|
cb67f2 |
--- a/testdata/testoutput2
|
|
|
cb67f2 |
+++ b/testdata/testoutput2
|
|
|
cb67f2 |
@@ -12515,4 +12515,6 @@ No match
|
|
|
cb67f2 |
End
|
|
|
cb67f2 |
------------------------------------------------------------------
|
|
|
cb67f2 |
|
|
|
cb67f2 |
+/(?<N111>(?J)(?<N111>1(111111)11|)1|1|)(?(<N111>)1)/
|
|
|
cb67f2 |
+
|
|
|
cb67f2 |
/-- End of testinput2 --/
|
|
|
cb67f2 |
--
|
|
|
cb67f2 |
2.5.5
|
|
|
cb67f2 |
|