diff options
author | John Lightsey <jd@cpanel.net> | 2019-11-20 20:02:45 -0600 |
---|---|---|
committer | Steve Hay <steve.m.hay@googlemail.com> | 2020-06-01 20:35:51 +0100 |
commit | 0e9563b9242a5758c6ce11daf8385b3753e9ed9c (patch) | |
tree | d3358c9fd77ac66e140da27470fdf1a38b330a40 | |
parent | 4b4b1fbd0d43429c43d5de8857f3266daba1dd66 (diff) | |
download | perl-0e9563b9242a5758c6ce11daf8385b3753e9ed9c.tar.gz |
regcomp.c: Prevent integer overflow from nested regex quantifiers.
(CVE-2020-10543) On 32bit systems the size calculations for nested regular
expression quantifiers could overflow causing heap memory corruption.
Fixes: Perl/perl5-security#125
(cherry picked from commit 670c54b00a47d930431dd470e72fd7d13643e169)
-rw-r--r-- | regcomp.c | 6 |
1 files changed, 6 insertions, 0 deletions
@@ -5615,6 +5615,12 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, RExC_precomp))); } + if ( ( minnext > 0 && mincount >= SSize_t_MAX / minnext ) + || min >= SSize_t_MAX - minnext * mincount ) + { + FAIL("Regexp out of space"); + } + min += minnext * mincount; is_inf_internal |= deltanext == OPTIMIZE_INFTY || (maxcount == REG_INFTY && minnext + deltanext > 0); |