|
 |
833ed6 |
From f0bb9e8baf3157e0a84f484f194984295b2db23a Mon Sep 17 00:00:00 2001
|
|
|
833ed6 |
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
|
|
|
833ed6 |
Date: Mon, 19 Oct 2020 16:15:14 +0200
|
|
|
833ed6 |
Subject: [PATCH] Inicialize name table memory region
|
|
|
833ed6 |
MIME-Version: 1.0
|
|
|
833ed6 |
Content-Type: text/plain; charset=UTF-8
|
|
|
833ed6 |
Content-Transfer-Encoding: 8bit
|
|
|
833ed6 |
|
|
|
833ed6 |
Name table entry values are accessed past their ends in add_name()
|
|
|
833ed6 |
when comparing the values. Also a size of the entries could grow
|
|
|
833ed6 |
later. It's safer to initialize just after the allocation than to hunt
|
|
|
833ed6 |
the gaps later.
|
|
|
833ed6 |
|
|
|
833ed6 |
Reproducer:
|
|
|
833ed6 |
|
|
|
833ed6 |
pcre_compile2("(?<f>)(?<fir>)", PCRE_NO_AUTO_CAPTURE | PCRE_CASELESS, &ec, &eb, &eo, NULL);
|
|
|
833ed6 |
|
|
|
833ed6 |
built with clang++ -fsanitize=memory -fsanitize=fuzzer-no-link.
|
|
|
833ed6 |
|
|
|
833ed6 |
https://bugs.exim.org/show_bug.cgi?id=2661
|
|
|
833ed6 |
Signed-off-by: Petr Písař <ppisar@redhat.com>
|
|
|
833ed6 |
---
|
|
|
833ed6 |
pcre_compile.c | 5 +++++
|
|
|
833ed6 |
1 file changed, 5 insertions(+)
|
|
|
833ed6 |
|
|
|
833ed6 |
diff --git a/pcre_compile.c b/pcre_compile.c
|
|
|
833ed6 |
index 3be0fbf..75309e0 100644
|
|
|
833ed6 |
--- a/pcre_compile.c
|
|
|
833ed6 |
+++ b/pcre_compile.c
|
|
|
833ed6 |
@@ -9423,6 +9423,11 @@ if (re == NULL)
|
|
|
833ed6 |
goto PCRE_EARLY_ERROR_RETURN;
|
|
|
833ed6 |
}
|
|
|
833ed6 |
|
|
|
833ed6 |
+/* Initialize the memory. Name table entry values are accessed past their ends
|
|
|
833ed6 |
+ * (e.g. in add_name()) when comparing the values. Also a size of the entry can
|
|
|
833ed6 |
+ * grow later. It's safer to initialize here than to hunt the gaps later. */
|
|
|
833ed6 |
+memset(re, 0, size);
|
|
|
833ed6 |
+
|
|
|
833ed6 |
/* Put in the magic number, and save the sizes, initial options, internal
|
|
|
833ed6 |
flags, and character table pointer. NULL is used for the default character
|
|
|
833ed6 |
tables. The nullpad field is at the end; it's there to help in the case when a
|
|
|
833ed6 |
--
|
|
|
833ed6 |
2.25.4
|
|
|
833ed6 |
|