diff options
| author | zherczeg <zherczeg@2f5784b3-3f2a-0410-8824-cb99058d5e15> | 2015-07-20 07:53:12 +0000 |
|---|---|---|
| committer | zherczeg <zherczeg@2f5784b3-3f2a-0410-8824-cb99058d5e15> | 2015-07-20 07:53:12 +0000 |
| commit | 32c5e4cd1777e53d0da4e5e7bbd227725d12fc14 (patch) | |
| tree | 3ea5086da571b4bfa556bd263666fb1e18c66505 /pcre_jit_compile.c | |
| parent | 14f400887deb587c8c36cb1bfa098840920f6944 (diff) | |
| download | pcre-32c5e4cd1777e53d0da4e5e7bbd227725d12fc14.tar.gz | |
Fix infinite recursion in the JIT compiler when certain patterns when certain patterns are analysed.
git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1577 2f5784b3-3f2a-0410-8824-cb99058d5e15
Diffstat (limited to 'pcre_jit_compile.c')
| -rw-r--r-- | pcre_jit_compile.c | 15 |
1 files changed, 11 insertions, 4 deletions
diff --git a/pcre_jit_compile.c b/pcre_jit_compile.c index 6aedcec..607742f 100644 --- a/pcre_jit_compile.c +++ b/pcre_jit_compile.c @@ -3214,7 +3214,7 @@ bytes[len] = byte; bytes[0] = len; } -static int scan_prefix(compiler_common *common, pcre_uchar *cc, pcre_uint32 *chars, pcre_uint8 *bytes, int max_chars) +static int scan_prefix(compiler_common *common, pcre_uchar *cc, pcre_uint32 *chars, pcre_uint8 *bytes, int max_chars, pcre_uint32 *rec_count) { /* Recursive function, which scans prefix literals. */ BOOL last, any, caseless; @@ -3232,9 +3232,14 @@ pcre_uchar othercase[1]; repeat = 1; while (TRUE) { + if (*rec_count == 0) + return 0; + rec_count--; + last = TRUE; any = FALSE; caseless = FALSE; + switch (*cc) { case OP_CHARI: @@ -3296,7 +3301,7 @@ while (TRUE) #ifdef SUPPORT_UTF if (common->utf && HAS_EXTRALEN(*cc)) len += GET_EXTRALEN(*cc); #endif - max_chars = scan_prefix(common, cc + len, chars, bytes, max_chars); + max_chars = scan_prefix(common, cc + len, chars, bytes, max_chars, rec_count); if (max_chars == 0) return consumed; last = FALSE; @@ -3319,7 +3324,7 @@ while (TRUE) alternative = cc + GET(cc, 1); while (*alternative == OP_ALT) { - max_chars = scan_prefix(common, alternative + 1 + LINK_SIZE, chars, bytes, max_chars); + max_chars = scan_prefix(common, alternative + 1 + LINK_SIZE, chars, bytes, max_chars, rec_count); if (max_chars == 0) return consumed; alternative += GET(alternative, 1); @@ -3561,6 +3566,7 @@ int i, max, from; int range_right = -1, range_len = 3 - 1; sljit_ub *update_table = NULL; BOOL in_range; +pcre_uint32 rec_count; for (i = 0; i < MAX_N_CHARS; i++) { @@ -3569,7 +3575,8 @@ for (i = 0; i < MAX_N_CHARS; i++) bytes[i * MAX_N_BYTES] = 0; } -max = scan_prefix(common, common->start, chars, bytes, MAX_N_CHARS); +rec_count = 10000; +max = scan_prefix(common, common->start, chars, bytes, MAX_N_CHARS, &rec_count); if (max <= 1) return FALSE; |