2eef5a
From 783ddef8fc74b00cde72898c2c3228853dc82d91 Mon Sep 17 00:00:00 2001
2eef5a
From: Hugo van der Sanden <hv@crypt.org>
2eef5a
Date: Sat, 11 Apr 2020 14:10:24 +0100
2eef5a
Subject: [PATCH] study_chunk: avoid mutating regexp program within GOSUB
2eef5a
MIME-Version: 1.0
2eef5a
Content-Type: text/plain; charset=UTF-8
2eef5a
Content-Transfer-Encoding: 8bit
2eef5a
2eef5a
gh16947 and gh17743: studying GOSUB may restudy in an inner call
2eef5a
(via a mix of recursion and enframing) something that an outer call
2eef5a
is in the middle of looking at.  Let the outer frame deal with it.
2eef5a
2eef5a
(CVE-2020-12723)
2eef5a
2eef5a
(cherry picked from commit c4033e740bd18d9fbe3456a9db2ec2053cdc5271)
2eef5a
Petr Písař: Ported to 5.30.1 from
2eef5a
66bbb51b93253a3f87d11c2695cfb7bdb782184a.
2eef5a
Signed-off-by: Petr Písař <ppisar@redhat.com>
2eef5a
---
2eef5a
 embed.fnc  |  2 +-
2eef5a
 embed.h    |  2 +-
2eef5a
 proto.h    |  2 +-
2eef5a
 regcomp.c  | 54 +++++++++++++++++++++++++++++++++++-------------------
2eef5a
 t/re/pat.t | 26 +++++++++++++++++++++++++-
2eef5a
 5 files changed, 63 insertions(+), 23 deletions(-)
2eef5a
2eef5a
diff --git a/embed.fnc b/embed.fnc
2eef5a
index 1b9cf54..d0463e4 100644
2eef5a
--- a/embed.fnc
2eef5a
+++ b/embed.fnc
2eef5a
@@ -2482,7 +2482,7 @@ Es	|SSize_t|study_chunk	|NN RExC_state_t *pRExC_state \
2eef5a
 				|NULLOK struct scan_data_t *data \
2eef5a
                                 |I32 stopparen|U32 recursed_depth \
2eef5a
 				|NULLOK regnode_ssc *and_withp \
2eef5a
-				|U32 flags|U32 depth
2eef5a
+				|U32 flags|U32 depth|bool was_mutate_ok
2eef5a
 Es	|void	|rck_elide_nothing|NN regnode *node
2eef5a
 EsR	|SV *	|get_ANYOFM_contents|NN const regnode * n
2eef5a
 EsRn	|U32	|add_data	|NN RExC_state_t* const pRExC_state \
2eef5a
diff --git a/embed.h b/embed.h
2eef5a
index cf44011..72c2a8e 100644
2eef5a
--- a/embed.h
2eef5a
+++ b/embed.h
2eef5a
@@ -1239,7 +1239,7 @@
2eef5a
 #define ssc_is_cp_posixl_init	S_ssc_is_cp_posixl_init
2eef5a
 #define ssc_or(a,b,c)		S_ssc_or(aTHX_ a,b,c)
2eef5a
 #define ssc_union(a,b,c)	S_ssc_union(aTHX_ a,b,c)
2eef5a
-#define study_chunk(a,b,c,d,e,f,g,h,i,j,k)	S_study_chunk(aTHX_ a,b,c,d,e,f,g,h,i,j,k)
2eef5a
+#define study_chunk(a,b,c,d,e,f,g,h,i,j,k,l)	S_study_chunk(aTHX_ a,b,c,d,e,f,g,h,i,j,k,l)
2eef5a
 #  endif
2eef5a
 #  if defined(PERL_IN_REGCOMP_C) || defined (PERL_IN_DUMP_C)
2eef5a
 #define _invlist_dump(a,b,c,d)	Perl__invlist_dump(aTHX_ a,b,c,d)
2eef5a
diff --git a/proto.h b/proto.h
2eef5a
index ee74153..9a3ce27 100644
2eef5a
--- a/proto.h
2eef5a
+++ b/proto.h
2eef5a
@@ -5671,7 +5671,7 @@ PERL_STATIC_INLINE void	S_ssc_union(pTHX_ regnode_ssc *ssc, SV* const invlist, c
2eef5a
 #define PERL_ARGS_ASSERT_SSC_UNION	\
2eef5a
 	assert(ssc); assert(invlist)
2eef5a
 #endif
2eef5a
-STATIC SSize_t	S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, SSize_t *minlenp, SSize_t *deltap, regnode *last, struct scan_data_t *data, I32 stopparen, U32 recursed_depth, regnode_ssc *and_withp, U32 flags, U32 depth);
2eef5a
+STATIC SSize_t	S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, SSize_t *minlenp, SSize_t *deltap, regnode *last, struct scan_data_t *data, I32 stopparen, U32 recursed_depth, regnode_ssc *and_withp, U32 flags, U32 depth, bool was_mutate_ok);
2eef5a
 #define PERL_ARGS_ASSERT_STUDY_CHUNK	\
2eef5a
 	assert(pRExC_state); assert(scanp); assert(minlenp); assert(deltap); assert(last)
2eef5a
 #endif
2eef5a
diff --git a/regcomp.c b/regcomp.c
2eef5a
index b101752..b9ea2a0 100644
2eef5a
--- a/regcomp.c
2eef5a
+++ b/regcomp.c
2eef5a
@@ -106,6 +106,7 @@ typedef struct scan_frame {
2eef5a
     regnode *next_regnode;      /* next node to process when last is reached */
2eef5a
     U32 prev_recursed_depth;
2eef5a
     I32 stopparen;              /* what stopparen do we use */
2eef5a
+    bool in_gosub;              /* this or an outer frame is for GOSUB */
2eef5a
 
2eef5a
     struct scan_frame *this_prev_frame; /* this previous frame */
2eef5a
     struct scan_frame *prev_frame;      /* previous frame */
2eef5a
@@ -4475,7 +4476,7 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
2eef5a
 			I32 stopparen,
2eef5a
                         U32 recursed_depth,
2eef5a
 			regnode_ssc *and_withp,
2eef5a
-			U32 flags, U32 depth)
2eef5a
+			U32 flags, U32 depth, bool was_mutate_ok)
2eef5a
 			/* scanp: Start here (read-write). */
2eef5a
 			/* deltap: Write maxlen-minlen here. */
2eef5a
 			/* last: Stop before this one. */
2eef5a
@@ -4554,6 +4555,10 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
2eef5a
                                    node length to get a real minimum (because
2eef5a
                                    the folded version may be shorter) */
2eef5a
 	bool unfolded_multi_char = FALSE;
2eef5a
+        /* avoid mutating ops if we are anywhere within the recursed or
2eef5a
+         * enframed handling for a GOSUB: the outermost level will handle it.
2eef5a
+         */
2eef5a
+        bool mutate_ok = was_mutate_ok && !(frame && frame->in_gosub);
2eef5a
 	/* Peephole optimizer: */
2eef5a
         DEBUG_STUDYDATA("Peep", data, depth, is_inf);
2eef5a
         DEBUG_PEEP("Peep", scan, depth, flags);
2eef5a
@@ -4564,7 +4569,8 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
2eef5a
          * parsing code, as each (?:..) is handled by a different invocation of
2eef5a
          * reg() -- Yves
2eef5a
          */
2eef5a
-        JOIN_EXACT(scan,&min_subtract, &unfolded_multi_char, 0);
2eef5a
+        if (mutate_ok)
2eef5a
+            JOIN_EXACT(scan,&min_subtract, &unfolded_multi_char, 0);
2eef5a
 
2eef5a
         /* Follow the next-chain of the current node and optimize
2eef5a
            away all the NOTHINGs from it.
2eef5a
@@ -4596,7 +4602,7 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
2eef5a
             /* DEFINEP study_chunk() recursion */
2eef5a
             (void)study_chunk(pRExC_state, &scan, &minlen,
2eef5a
                               &deltanext, next, &data_fake, stopparen,
2eef5a
-                              recursed_depth, NULL, f, depth+1);
2eef5a
+                              recursed_depth, NULL, f, depth+1, mutate_ok);
2eef5a
 
2eef5a
             scan = next;
2eef5a
         } else
2eef5a
@@ -4664,7 +4670,8 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
2eef5a
                     /* recurse study_chunk() for each BRANCH in an alternation */
2eef5a
 		    minnext = study_chunk(pRExC_state, &scan, minlenp,
2eef5a
                                       &deltanext, next, &data_fake, stopparen,
2eef5a
-                                      recursed_depth, NULL, f, depth+1);
2eef5a
+                                      recursed_depth, NULL, f, depth+1,
2eef5a
+                                      mutate_ok);
2eef5a
 
2eef5a
 		    if (min1 > minnext)
2eef5a
 			min1 = minnext;
2eef5a
@@ -4731,9 +4738,10 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
2eef5a
 		    }
2eef5a
 		}
2eef5a
 
2eef5a
-                if (PERL_ENABLE_TRIE_OPTIMISATION &&
2eef5a
-                        OP( startbranch ) == BRANCH )
2eef5a
-                {
2eef5a
+                if (PERL_ENABLE_TRIE_OPTIMISATION
2eef5a
+                    && OP(startbranch) == BRANCH
2eef5a
+                    && mutate_ok
2eef5a
+                ) {
2eef5a
 		/* demq.
2eef5a
 
2eef5a
                    Assuming this was/is a branch we are dealing with: 'scan'
2eef5a
@@ -5188,6 +5196,9 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
2eef5a
                 newframe->stopparen = stopparen;
2eef5a
                 newframe->prev_recursed_depth = recursed_depth;
2eef5a
                 newframe->this_prev_frame= frame;
2eef5a
+                newframe->in_gosub = (
2eef5a
+                    (frame && frame->in_gosub) || OP(scan) == GOSUB
2eef5a
+                );
2eef5a
 
2eef5a
                 DEBUG_STUDYDATA("frame-new", data, depth, is_inf);
2eef5a
                 DEBUG_PEEP("fnew", scan, depth, flags);
2eef5a
@@ -5345,7 +5356,7 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
2eef5a
 
2eef5a
                 /* This temporary node can now be turned into EXACTFU, and
2eef5a
                  * must, as regexec.c doesn't handle it */
2eef5a
-                if (OP(next) == EXACTFU_S_EDGE) {
2eef5a
+                if (OP(next) == EXACTFU_S_EDGE && mutate_ok) {
2eef5a
                     OP(next) = EXACTFU;
2eef5a
                 }
2eef5a
 
2eef5a
@@ -5353,8 +5364,9 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
2eef5a
                     &&   isALPHA_A(* STRING(next))
2eef5a
                     && (         OP(next) == EXACTFAA
2eef5a
                         || (     OP(next) == EXACTFU
2eef5a
-                            && ! HAS_NONLATIN1_SIMPLE_FOLD_CLOSURE(* STRING(next)))))
2eef5a
-                {
2eef5a
+                            && ! HAS_NONLATIN1_SIMPLE_FOLD_CLOSURE(* STRING(next))))
2eef5a
+                    &&   mutate_ok
2eef5a
+                ) {
2eef5a
                     /* These differ in just one bit */
2eef5a
                     U8 mask = ~ ('A' ^ 'a');
2eef5a
 
2eef5a
@@ -5441,7 +5453,7 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
2eef5a
                                   (mincount == 0
2eef5a
                                    ? (f & ~SCF_DO_SUBSTR)
2eef5a
                                    : f)
2eef5a
-                                  ,depth+1);
2eef5a
+                                  , depth+1, mutate_ok);
2eef5a
 
2eef5a
 		if (flags & SCF_DO_STCLASS)
2eef5a
 		    data->start_class = oclass;
2eef5a
@@ -5507,7 +5519,9 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
2eef5a
 		if (  OP(oscan) == CURLYX && data
2eef5a
 		      && data->flags & SF_IN_PAR
2eef5a
 		      && !(data->flags & SF_HAS_EVAL)
2eef5a
-		      && !deltanext && minnext == 1 ) {
2eef5a
+		      && !deltanext && minnext == 1
2eef5a
+                      && mutate_ok
2eef5a
+                ) {
2eef5a
 		    /* Try to optimize to CURLYN.  */
2eef5a
 		    regnode *nxt = NEXTOPER(oscan) + EXTRA_STEP_2ARGS;
2eef5a
 		    regnode * const nxt1 = nxt;
2eef5a
@@ -5557,10 +5571,10 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
2eef5a
 		      && !(data->flags & SF_HAS_EVAL)
2eef5a
 		      && !deltanext	/* atom is fixed width */
2eef5a
 		      && minnext != 0	/* CURLYM can't handle zero width */
2eef5a
-
2eef5a
                          /* Nor characters whose fold at run-time may be
2eef5a
                           * multi-character */
2eef5a
                       && ! (RExC_seen & REG_UNFOLDED_MULTI_SEEN)
2eef5a
+                      && mutate_ok
2eef5a
 		) {
2eef5a
 		    /* XXXX How to optimize if data == 0? */
2eef5a
 		    /* Optimize to a simpler form.  */
2eef5a
@@ -5613,7 +5627,7 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
2eef5a
                         /* recurse study_chunk() on optimised CURLYX => CURLYM */
2eef5a
 			study_chunk(pRExC_state, &nxt1, minlenp, &deltanext, nxt,
2eef5a
                                     NULL, stopparen, recursed_depth, NULL, 0,
2eef5a
-                                    depth+1);
2eef5a
+                                    depth+1, mutate_ok);
2eef5a
 		    }
2eef5a
 		    else
2eef5a
 			oscan->flags = 0;
2eef5a
@@ -6018,7 +6032,8 @@ Perl_re_printf( aTHX_  "LHS=%" UVuf " RHS=%" UVuf "\n",
2eef5a
                 /* recurse study_chunk() for lookahead body */
2eef5a
                 minnext = study_chunk(pRExC_state, &nscan, minlenp, &deltanext,
2eef5a
                                       last, &data_fake, stopparen,
2eef5a
-                                      recursed_depth, NULL, f, depth+1);
2eef5a
+                                      recursed_depth, NULL, f, depth+1,
2eef5a
+                                      mutate_ok);
2eef5a
                 if (scan->flags) {
2eef5a
                     if (   deltanext < 0
2eef5a
                         || deltanext > (I32) U8_MAX
2eef5a
@@ -6123,7 +6138,7 @@ Perl_re_printf( aTHX_  "LHS=%" UVuf " RHS=%" UVuf "\n",
2eef5a
                 *minnextp = study_chunk(pRExC_state, &nscan, minnextp,
2eef5a
                                         &deltanext, last, &data_fake,
2eef5a
                                         stopparen, recursed_depth, NULL,
2eef5a
-                                        f, depth+1);
2eef5a
+                                        f, depth+1, mutate_ok);
2eef5a
                 if (scan->flags) {
2eef5a
                     assert(0);  /* This code has never been tested since this
2eef5a
                                    is normally not compiled */
2eef5a
@@ -6291,7 +6306,8 @@ Perl_re_printf( aTHX_  "LHS=%" UVuf " RHS=%" UVuf "\n",
2eef5a
                         /* optimise study_chunk() for TRIE */
2eef5a
                         minnext = study_chunk(pRExC_state, &scan, minlenp,
2eef5a
                             &deltanext, (regnode *)nextbranch, &data_fake,
2eef5a
-                            stopparen, recursed_depth, NULL, f, depth+1);
2eef5a
+                            stopparen, recursed_depth, NULL, f, depth+1,
2eef5a
+                            mutate_ok);
2eef5a
                     }
2eef5a
                     if (nextbranch && PL_regkind[OP(nextbranch)]==BRANCH)
2eef5a
                         nextbranch= regnext((regnode*)nextbranch);
2eef5a
@@ -8084,7 +8100,7 @@ Perl_re_op_compile(pTHX_ SV ** const patternp, int pat_count,
2eef5a
             &data, -1, 0, NULL,
2eef5a
             SCF_DO_SUBSTR | SCF_WHILEM_VISITED_POS | stclass_flag
2eef5a
                           | (restudied ? SCF_TRIE_DOING_RESTUDY : 0),
2eef5a
-            0);
2eef5a
+            0, TRUE);
2eef5a
 
2eef5a
 
2eef5a
         CHECK_RESTUDY_GOTO_butfirst(LEAVE_with_name("study_chunk"));
2eef5a
@@ -8213,7 +8229,7 @@ Perl_re_op_compile(pTHX_ SV ** const patternp, int pat_count,
2eef5a
             SCF_DO_STCLASS_AND|SCF_WHILEM_VISITED_POS|(restudied
2eef5a
                                                       ? SCF_TRIE_DOING_RESTUDY
2eef5a
                                                       : 0),
2eef5a
-            0);
2eef5a
+            0, TRUE);
2eef5a
 
2eef5a
         CHECK_RESTUDY_GOTO_butfirst(NOOP);
2eef5a
 
2eef5a
diff --git a/t/re/pat.t b/t/re/pat.t
2eef5a
index 6a868f4..ba89a58 100644
2eef5a
--- a/t/re/pat.t
2eef5a
+++ b/t/re/pat.t
2eef5a
@@ -25,7 +25,7 @@ BEGIN {
2eef5a
 skip_all('no re module') unless defined &DynaLoader::boot_DynaLoader;
2eef5a
 skip_all_without_unicode_tables();
2eef5a
 
2eef5a
-plan tests => 864;  # Update this when adding/deleting tests.
2eef5a
+plan tests => 868;  # Update this when adding/deleting tests.
2eef5a
 
2eef5a
 run_tests() unless caller;
2eef5a
 
2eef5a
@@ -2115,6 +2115,30 @@ x{0c!}\;\;îçÿ /0f/!F?/;îçÿù\Q?x?ÿÿÿÿù`x{0c!}?;ù\Q
2eef5a
         like(runperl(prog => "$s", stderr => 1), qr/Unmatched \(/);
2eef5a
    }
2eef5a
 
2eef5a
+    # gh16947: test regexp corruption (GOSUB)
2eef5a
+    {
2eef5a
+        fresh_perl_is(q{
2eef5a
+            'xy' =~ /x(?0)|x(?|y|y)/ && print 'ok'
2eef5a
+        }, 'ok', {}, 'gh16947: test regexp corruption (GOSUB)');
2eef5a
+    }
2eef5a
+    # gh16947: test fix doesn't break SUSPEND
2eef5a
+    {
2eef5a
+        fresh_perl_is(q{ 'sx' =~ m{ss++}i; print 'ok' },
2eef5a
+                'ok', {}, "gh16947: test fix doesn't break SUSPEND");
2eef5a
+    }
2eef5a
+
2eef5a
+    # gh17743: more regexp corruption via GOSUB
2eef5a
+    {
2eef5a
+        fresh_perl_is(q{
2eef5a
+            "0" =~ /((0(?0)|000(?|0000|0000)(?0))|)/; print "ok"
2eef5a
+        }, 'ok', {}, 'gh17743: test regexp corruption (1)');
2eef5a
+
2eef5a
+        fresh_perl_is(q{
2eef5a
+            "000000000000" =~ /(0(())(0((?0)())|000(?|\x{ef}\x{bf}\x{bd}|\x{ef}\x{bf}\x{bd}))|)/;
2eef5a
+            print "ok"
2eef5a
+        }, 'ok', {}, 'gh17743: test regexp corruption (2)');
2eef5a
+    }
2eef5a
+
2eef5a
 } # End of sub run_tests
2eef5a
 
2eef5a
 1;
2eef5a
-- 
2eef5a
2.25.4
2eef5a