|
 |
a1b23f |
From 3a9026509f9c1745f378595e55e5024361ad152d Mon Sep 17 00:00:00 2001
|
|
|
a1b23f |
From: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
|
|
|
a1b23f |
Date: Mon, 10 Feb 2020 17:17:34 +0000
|
|
|
a1b23f |
Subject: [PATCH] Check the size of the number after (?C as it is read, in
|
|
|
a1b23f |
order to avoid integer overflow.
|
|
|
a1b23f |
MIME-Version: 1.0
|
|
|
a1b23f |
Content-Type: text/plain; charset=UTF-8
|
|
|
a1b23f |
Content-Transfer-Encoding: 8bit
|
|
|
a1b23f |
|
|
|
a1b23f |
git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1761 2f5784b3-3f2a-0410-8824-cb99058d5e15
|
|
|
a1b23f |
Petr Písař: Ported to 8.43.
|
|
|
a1b23f |
---
|
|
|
a1b23f |
pcre_compile.c | 14 ++++++++------
|
|
|
a1b23f |
|
|
|
a1b23f |
diff --git a/pcre_compile.c b/pcre_compile.c
|
|
|
a1b23f |
index 079d30a..1e3d6c3 100644
|
|
|
a1b23f |
--- a/pcre_compile.c
|
|
|
a1b23f |
+++ b/pcre_compile.c
|
|
|
a1b23f |
@@ -6,7 +6,7 @@
|
|
|
a1b23f |
and semantics are as close as possible to those of the Perl 5 language.
|
|
|
a1b23f |
|
|
|
a1b23f |
Written by Philip Hazel
|
|
|
a1b23f |
- Copyright (c) 1997-2018 University of Cambridge
|
|
|
a1b23f |
+ Copyright (c) 1997-2020 University of Cambridge
|
|
|
a1b23f |
|
|
|
a1b23f |
-----------------------------------------------------------------------------
|
|
|
a1b23f |
Redistribution and use in source and binary forms, with or without
|
|
|
a1b23f |
@@ -7130,17 +7130,19 @@ for (;; ptr++)
|
|
|
a1b23f |
int n = 0;
|
|
|
a1b23f |
ptr++;
|
|
|
a1b23f |
while(IS_DIGIT(*ptr))
|
|
|
a1b23f |
+ {
|
|
|
a1b23f |
n = n * 10 + *ptr++ - CHAR_0;
|
|
|
a1b23f |
+ if (n > 255)
|
|
|
a1b23f |
+ {
|
|
|
a1b23f |
+ *errorcodeptr = ERR38;
|
|
|
a1b23f |
+ goto FAILED;
|
|
|
a1b23f |
+ }
|
|
|
a1b23f |
+ }
|
|
|
a1b23f |
if (*ptr != CHAR_RIGHT_PARENTHESIS)
|
|
|
a1b23f |
{
|
|
|
a1b23f |
*errorcodeptr = ERR39;
|
|
|
a1b23f |
goto FAILED;
|
|
|
a1b23f |
}
|
|
|
a1b23f |
- if (n > 255)
|
|
|
a1b23f |
- {
|
|
|
a1b23f |
- *errorcodeptr = ERR38;
|
|
|
a1b23f |
- goto FAILED;
|
|
|
a1b23f |
- }
|
|
|
a1b23f |
*code++ = n;
|
|
|
a1b23f |
PUT(code, 0, (int)(ptr - cd->start_pattern + 1)); /* Pattern offset */
|
|
|
a1b23f |
PUT(code, LINK_SIZE, 0); /* Default length */
|
|
|
a1b23f |
--
|
|
|
a1b23f |
2.21.1
|
|
|
a1b23f |
|