summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>2020-02-10 17:17:34 +0000
committerph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>2020-02-10 17:17:34 +0000
commit3a9026509f9c1745f378595e55e5024361ad152d (patch)
treef1cdc6b489a078b7b550e09fc42c32381b353513
parent3564d44ed1e70f1bf1e85b75274699b6720792ff (diff)
downloadpcre-3a9026509f9c1745f378595e55e5024361ad152d.tar.gz
Check the size of the number after (?C as it is read, in order to avoid integer
overflow. git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1761 2f5784b3-3f2a-0410-8824-cb99058d5e15
-rw-r--r--ChangeLog3
-rw-r--r--pcre_compile.c14
2 files changed, 11 insertions, 6 deletions
diff --git a/ChangeLog b/ChangeLog
index 1106d04..e5aa0e5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -27,6 +27,9 @@ added.
after a successful compile, instead of at the start of matching to avoid a
sanitizer complaint (regexec is supposed to be thread safe).
+6. Check the size of the number after (?C as it is read, in order to avoid
+integer overflow.
+
Version 8.43 23-February-2019
-----------------------------
diff --git a/pcre_compile.c b/pcre_compile.c
index 079d30a..1e3d6c3 100644
--- a/pcre_compile.c
+++ b/pcre_compile.c
@@ -6,7 +6,7 @@
and semantics are as close as possible to those of the Perl 5 language.
Written by Philip Hazel
- Copyright (c) 1997-2018 University of Cambridge
+ Copyright (c) 1997-2020 University of Cambridge
-----------------------------------------------------------------------------
Redistribution and use in source and binary forms, with or without
@@ -7130,17 +7130,19 @@ for (;; ptr++)
int n = 0;
ptr++;
while(IS_DIGIT(*ptr))
+ {
n = n * 10 + *ptr++ - CHAR_0;
+ if (n > 255)
+ {
+ *errorcodeptr = ERR38;
+ goto FAILED;
+ }
+ }
if (*ptr != CHAR_RIGHT_PARENTHESIS)
{
*errorcodeptr = ERR39;
goto FAILED;
}
- if (n > 255)
- {
- *errorcodeptr = ERR38;
- goto FAILED;
- }
*code++ = n;
PUT(code, 0, (int)(ptr - cd->start_pattern + 1)); /* Pattern offset */
PUT(code, LINK_SIZE, 0); /* Default length */