Blame SOURCES/pcre-8.43-Check-the-size-of-the-number-after-C-as-it-is-read-i.patch

c07340
From 3a9026509f9c1745f378595e55e5024361ad152d Mon Sep 17 00:00:00 2001
c07340
From: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
c07340
Date: Mon, 10 Feb 2020 17:17:34 +0000
c07340
Subject: [PATCH] Check the size of the number after (?C as it is read, in
c07340
 order to avoid integer overflow.
c07340
MIME-Version: 1.0
c07340
Content-Type: text/plain; charset=UTF-8
c07340
Content-Transfer-Encoding: 8bit
c07340
c07340
git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1761 2f5784b3-3f2a-0410-8824-cb99058d5e15
c07340
Petr Písař: Ported to 8.43.
c07340
---
c07340
 pcre_compile.c | 14 ++++++++------
c07340
c07340
diff --git a/pcre_compile.c b/pcre_compile.c
c07340
index 079d30a..1e3d6c3 100644
c07340
--- a/pcre_compile.c
c07340
+++ b/pcre_compile.c
c07340
@@ -6,7 +6,7 @@
c07340
 and semantics are as close as possible to those of the Perl 5 language.
c07340
 
c07340
                        Written by Philip Hazel
c07340
-           Copyright (c) 1997-2018 University of Cambridge
c07340
+           Copyright (c) 1997-2020 University of Cambridge
c07340
 
c07340
 -----------------------------------------------------------------------------
c07340
 Redistribution and use in source and binary forms, with or without
c07340
@@ -7130,17 +7130,19 @@ for (;; ptr++)
c07340
           int n = 0;
c07340
           ptr++;
c07340
           while(IS_DIGIT(*ptr))
c07340
+            { 
c07340
             n = n * 10 + *ptr++ - CHAR_0;
c07340
+            if (n > 255)
c07340
+              {
c07340
+              *errorcodeptr = ERR38;
c07340
+              goto FAILED;
c07340
+              }
c07340
+            } 
c07340
           if (*ptr != CHAR_RIGHT_PARENTHESIS)
c07340
             {
c07340
             *errorcodeptr = ERR39;
c07340
             goto FAILED;
c07340
             }
c07340
-          if (n > 255)
c07340
-            {
c07340
-            *errorcodeptr = ERR38;
c07340
-            goto FAILED;
c07340
-            }
c07340
           *code++ = n;
c07340
           PUT(code, 0, (int)(ptr - cd->start_pattern + 1)); /* Pattern offset */
c07340
           PUT(code, LINK_SIZE, 0);                          /* Default length */
c07340
-- 
c07340
2.21.1
c07340