diff options
author | John Lightsey <jd@cpanel.net> | 2019-11-20 20:02:45 -0600 |
---|---|---|
committer | Steve Hay <steve.m.hay@googlemail.com> | 2020-05-17 10:48:17 +0100 |
commit | 897d1f7fd515b828e4b198d8b8bef76c6faf03ed (patch) | |
tree | ba6367a20adfdfb89c5d3751893ea3c7be12fcb1 | |
parent | 7ece5938f0fb4d8ffab9cc9bd83a133c74dff34f (diff) | |
download | perl-897d1f7fd515b828e4b198d8b8bef76c6faf03ed.tar.gz |
regcomp.c: Prevent integer overflow from nested regex quantifiers.
(CVE-2020-10543) On 32bit systems the size calculations for nested regular
expression quantifiers could overflow causing heap memory corruption.
Fixes: Perl/perl5-security#125
(cherry picked from commit bfd31397db5dc1a5c5d3e0a1f753a4f89a736e71)
-rw-r--r-- | regcomp.c | 6 |
1 files changed, 6 insertions, 0 deletions
@@ -5489,6 +5489,12 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, RExC_precomp))); } + if ( ( minnext > 0 && mincount >= SSize_t_MAX / minnext ) + || min >= SSize_t_MAX - minnext * mincount ) + { + FAIL("Regexp out of space"); + } + min += minnext * mincount; is_inf_internal |= deltanext == SSize_t_MAX || (maxcount == REG_INFTY && minnext + deltanext > 0); |