From 897d1f7fd515b828e4b198d8b8bef76c6faf03ed Mon Sep 17 00:00:00 2001 From: John Lightsey Date: Wed, 20 Nov 2019 20:02:45 -0600 Subject: [PATCH] regcomp.c: Prevent integer overflow from nested regex quantifiers. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit (CVE-2020-10543) On 32bit systems the size calculations for nested regular expression quantifiers could overflow causing heap memory corruption. Fixes: Perl/perl5-security#125 (cherry picked from commit bfd31397db5dc1a5c5d3e0a1f753a4f89a736e71) Signed-off-by: Petr Písař --- regcomp.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/regcomp.c b/regcomp.c index 93c8d98fbb..5f86be8086 100644 --- a/regcomp.c +++ b/regcomp.c @@ -5489,6 +5489,12 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, RExC_precomp))); } + if ( ( minnext > 0 && mincount >= SSize_t_MAX / minnext ) + || min >= SSize_t_MAX - minnext * mincount ) + { + FAIL("Regexp out of space"); + } + min += minnext * mincount; is_inf_internal |= deltanext == SSize_t_MAX || (maxcount == REG_INFTY && minnext + deltanext > 0); -- 2.25.4