|
 |
4b4994 |
From 943a5105b9fe2842851003f692c7077a6cdbeefe Mon Sep 17 00:00:00 2001
|
|
|
4b4994 |
From: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
|
|
|
4b4994 |
Date: Wed, 10 Feb 2016 19:13:17 +0000
|
|
|
4b4994 |
Subject: [PATCH] Fix workspace overflow for (*ACCEPT) with deeply nested
|
|
|
4b4994 |
parentheses.
|
|
|
4b4994 |
MIME-Version: 1.0
|
|
|
4b4994 |
Content-Type: text/plain; charset=UTF-8
|
|
|
4b4994 |
Content-Transfer-Encoding: 8bit
|
|
|
4b4994 |
|
|
|
4b4994 |
git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1631 2f5784b3-3f2a-0410-8824-cb99058d5e15
|
|
|
4b4994 |
|
|
|
4b4994 |
Petr Písař: Ported to 8.38.
|
|
|
4b4994 |
|
|
|
4b4994 |
diff --git a/pcre_compile.c b/pcre_compile.c
|
|
|
4b4994 |
index b9a239e..5019854 100644
|
|
|
4b4994 |
--- a/pcre_compile.c
|
|
|
4b4994 |
+++ b/pcre_compile.c
|
|
|
4b4994 |
@@ -6,7 +6,7 @@
|
|
|
4b4994 |
and semantics are as close as possible to those of the Perl 5 language.
|
|
|
4b4994 |
|
|
|
4b4994 |
Written by Philip Hazel
|
|
|
4b4994 |
- Copyright (c) 1997-2014 University of Cambridge
|
|
|
4b4994 |
+ Copyright (c) 1997-2016 University of Cambridge
|
|
|
4b4994 |
|
|
|
4b4994 |
-----------------------------------------------------------------------------
|
|
|
4b4994 |
Redistribution and use in source and binary forms, with or without
|
|
|
4b4994 |
@@ -560,6 +560,7 @@ static const char error_texts[] =
|
|
|
4b4994 |
/* 85 */
|
|
|
4b4994 |
"parentheses are too deeply nested (stack check)\0"
|
|
|
4b4994 |
"digits missing in \\x{} or \\o{}\0"
|
|
|
4b4994 |
+ "regular expression is too complicated\0"
|
|
|
4b4994 |
;
|
|
|
4b4994 |
|
|
|
4b4994 |
/* Table to identify digits and hex digits. This is used when compiling
|
|
|
4b4994 |
@@ -4591,7 +4592,8 @@ for (;; ptr++)
|
|
|
4b4994 |
if (code > cd->start_workspace + cd->workspace_size -
|
|
|
4b4994 |
WORK_SIZE_SAFETY_MARGIN) /* Check for overrun */
|
|
|
4b4994 |
{
|
|
|
4b4994 |
- *errorcodeptr = ERR52;
|
|
|
4b4994 |
+ *errorcodeptr = (code >= cd->start_workspace + cd->workspace_size)?
|
|
|
4b4994 |
+ ERR52 : ERR87;
|
|
|
4b4994 |
goto FAILED;
|
|
|
4b4994 |
}
|
|
|
4b4994 |
|
|
|
4b4994 |
@@ -6626,8 +6628,21 @@ for (;; ptr++)
|
|
|
4b4994 |
cd->had_accept = TRUE;
|
|
|
4b4994 |
for (oc = cd->open_caps; oc != NULL; oc = oc->next)
|
|
|
4b4994 |
{
|
|
|
4b4994 |
- *code++ = OP_CLOSE;
|
|
|
4b4994 |
- PUT2INC(code, 0, oc->number);
|
|
|
4b4994 |
+ if (lengthptr != NULL)
|
|
|
4b4994 |
+ {
|
|
|
4b4994 |
+#ifdef COMPILE_PCRE8
|
|
|
4b4994 |
+ *lengthptr += 1 + IMM2_SIZE;
|
|
|
4b4994 |
+#elif defined COMPILE_PCRE16
|
|
|
4b4994 |
+ *lengthptr += 2 + IMM2_SIZE;
|
|
|
4b4994 |
+#elif defined COMPILE_PCRE32
|
|
|
4b4994 |
+ *lengthptr += 4 + IMM2_SIZE;
|
|
|
4b4994 |
+#endif
|
|
|
4b4994 |
+ }
|
|
|
4b4994 |
+ else
|
|
|
4b4994 |
+ {
|
|
|
4b4994 |
+ *code++ = OP_CLOSE;
|
|
|
4b4994 |
+ PUT2INC(code, 0, oc->number);
|
|
|
4b4994 |
+ }
|
|
|
4b4994 |
}
|
|
|
4b4994 |
setverb = *code++ =
|
|
|
4b4994 |
(cd->assert_depth > 0)? OP_ASSERT_ACCEPT : OP_ACCEPT;
|
|
|
4b4994 |
diff --git a/pcre_internal.h b/pcre_internal.h
|
|
|
4b4994 |
index f7a5ee7..dbfe80e 100644
|
|
|
4b4994 |
--- a/pcre_internal.h
|
|
|
4b4994 |
+++ b/pcre_internal.h
|
|
|
4b4994 |
@@ -7,7 +7,7 @@
|
|
|
4b4994 |
and semantics are as close as possible to those of the Perl 5 language.
|
|
|
4b4994 |
|
|
|
4b4994 |
Written by Philip Hazel
|
|
|
4b4994 |
- Copyright (c) 1997-2014 University of Cambridge
|
|
|
4b4994 |
+ Copyright (c) 1997-2016 University of Cambridge
|
|
|
4b4994 |
|
|
|
4b4994 |
-----------------------------------------------------------------------------
|
|
|
4b4994 |
Redistribution and use in source and binary forms, with or without
|
|
|
4b4994 |
@@ -2289,7 +2289,7 @@ enum { ERR0, ERR1, ERR2, ERR3, ERR4, ERR5, ERR6, ERR7, ERR8, ERR9,
|
|
|
4b4994 |
ERR50, ERR51, ERR52, ERR53, ERR54, ERR55, ERR56, ERR57, ERR58, ERR59,
|
|
|
4b4994 |
ERR60, ERR61, ERR62, ERR63, ERR64, ERR65, ERR66, ERR67, ERR68, ERR69,
|
|
|
4b4994 |
ERR70, ERR71, ERR72, ERR73, ERR74, ERR75, ERR76, ERR77, ERR78, ERR79,
|
|
|
4b4994 |
- ERR80, ERR81, ERR82, ERR83, ERR84, ERR85, ERR86, ERRCOUNT };
|
|
|
4b4994 |
+ ERR80, ERR81, ERR82, ERR83, ERR84, ERR85, ERR86, ERR87, ERRCOUNT };
|
|
|
4b4994 |
|
|
|
4b4994 |
/* JIT compiling modes. The function list is indexed by them. */
|
|
|
4b4994 |
|
|
|
4b4994 |
diff --git a/pcreposix.c b/pcreposix.c
|
|
|
4b4994 |
index dcc13ef..55b6ddc 100644
|
|
|
4b4994 |
--- a/pcreposix.c
|
|
|
4b4994 |
+++ b/pcreposix.c
|
|
|
4b4994 |
@@ -6,7 +6,7 @@
|
|
|
4b4994 |
and semantics are as close as possible to those of the Perl 5 language.
|
|
|
4b4994 |
|
|
|
4b4994 |
Written by Philip Hazel
|
|
|
4b4994 |
- Copyright (c) 1997-2014 University of Cambridge
|
|
|
4b4994 |
+ Copyright (c) 1997-2016 University of Cambridge
|
|
|
4b4994 |
|
|
|
4b4994 |
-----------------------------------------------------------------------------
|
|
|
4b4994 |
Redistribution and use in source and binary forms, with or without
|
|
|
4b4994 |
@@ -173,7 +173,8 @@ static const int eint[] = {
|
|
|
4b4994 |
REG_BADPAT, /* group name must start with a non-digit */
|
|
|
4b4994 |
/* 85 */
|
|
|
4b4994 |
REG_BADPAT, /* parentheses too deeply nested (stack check) */
|
|
|
4b4994 |
- REG_BADPAT /* missing digits in \x{} or \o{} */
|
|
|
4b4994 |
+ REG_BADPAT, /* missing digits in \x{} or \o{} */
|
|
|
4b4994 |
+ REG_BADPAT /* pattern too complicated */
|
|
|
4b4994 |
};
|
|
|
4b4994 |
|
|
|
4b4994 |
/* Table of texts corresponding to POSIX error codes */
|
|
|
4b4994 |
diff --git a/testdata/testinput11 b/testdata/testinput11
|
|
|
4b4994 |
index ac9d228..6f0989a 100644
|
|
|
4b4994 |
--- a/testdata/testinput11
|
|
|
4b4994 |
+++ b/testdata/testinput11
|
|
|
4b4994 |
@@ -138,4 +138,6 @@ is required for these tests. --/
|
|
|
4b4994 |
|
|
|
4b4994 |
/.((?2)(?R)\1)()/B
|
|
|
4b4994 |
|
|
|
4b4994 |
+/([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00](*ACCEPT)/
|
|
|
4b4994 |
+
|
|
|
4b4994 |
/-- End of testinput11 --/
|
|
|
4b4994 |
diff --git a/testdata/testoutput11-16 b/testdata/testoutput11-16
|
|
|
4b4994 |
index 280692e..3c485da 100644
|
|
|
4b4994 |
--- a/testdata/testoutput11-16
|
|
|
4b4994 |
+++ b/testdata/testoutput11-16
|
|
|
4b4994 |
@@ -765,4 +765,7 @@ Memory allocation (code space): 14
|
|
|
4b4994 |
25 End
|
|
|
4b4994 |
------------------------------------------------------------------
|
|
|
4b4994 |
|
|
|
4b4994 |
+/([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00](*ACCEPT)/
|
|
|
4b4994 |
+Failed: regular expression is too complicated at offset 490
|
|
|
4b4994 |
+
|
|
|
4b4994 |
/-- End of testinput11 --/
|
|
|
4b4994 |
diff --git a/testdata/testoutput11-32 b/testdata/testoutput11-32
|
|
|
4b4994 |
index cdbda74..e19518d 100644
|
|
|
4b4994 |
--- a/testdata/testoutput11-32
|
|
|
4b4994 |
+++ b/testdata/testoutput11-32
|
|
|
4b4994 |
@@ -765,4 +765,7 @@ Memory allocation (code space): 28
|
|
|
4b4994 |
25 End
|
|
|
4b4994 |
------------------------------------------------------------------
|
|
|
4b4994 |
|
|
|
4b4994 |
+/([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00](*ACCEPT)/
|
|
|
4b4994 |
+Failed: missing ) at offset 509
|
|
|
4b4994 |
+
|
|
|
4b4994 |
/-- End of testinput11 --/
|
|
|
4b4994 |
diff --git a/testdata/testoutput11-8 b/testdata/testoutput11-8
|
|
|
4b4994 |
index cb37896..5a4fbb2 100644
|
|
|
4b4994 |
--- a/testdata/testoutput11-8
|
|
|
4b4994 |
+++ b/testdata/testoutput11-8
|
|
|
4b4994 |
@@ -765,4 +765,7 @@ Memory allocation (code space): 10
|
|
|
4b4994 |
38 End
|
|
|
4b4994 |
------------------------------------------------------------------
|
|
|
4b4994 |
|
|
|
4b4994 |
+/([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00](*ACCEPT)/
|
|
|
4b4994 |
+Failed: missing ) at offset 509
|
|
|
4b4994 |
+
|
|
|
4b4994 |
/-- End of testinput11 --/
|
|
|
4b4994 |
--
|
|
|
4b4994 |
2.5.0
|
|
|
4b4994 |
|