summaryrefslogtreecommitdiff
path: root/regexec.c
diff options
context:
space:
mode:
authorYves Orton <demerphq@gmail.com>2016-10-31 20:22:37 +0100
committerYves Orton <demerphq@gmail.com>2016-11-01 13:29:48 +0100
commit5585e758ec847fcd75936b77096edf5234d6e0c0 (patch)
tree1067e5d69b4a4ffc029abad8b9afce586b5aa91e /regexec.c
parent27deb0cf05ad74bec9ea0da3d1b6405346a66401 (diff)
downloadperl-5585e758ec847fcd75936b77096edf5234d6e0c0.tar.gz
rework perl #129903 - inf recursion from use of empty pattern in regex codeblock
FC didn't like my previous patch for this issue, so here is the one he likes better. With tests and etc. :-) The basic problem is that code like this: /(?{ s!!! })/ can trigger infinite recursion on the C stack (not the normal perl stack) when the last successful pattern in scope is itself. Since the C stack overflows this manifests as an untrappable error/segfault, which then kills perl. We avoid the segfault by simply forbidding the use of the empty pattern when it would resolve to the currently executing pattern. I imagine with a bit of effort someone can trigger the original SEGV, unlike my original fix which forbade use of the empty pattern in a regex code block. So if someone actually reports such a bug we might have to revert to the older approach of prohibiting this.
Diffstat (limited to 'regexec.c')
-rw-r--r--regexec.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/regexec.c b/regexec.c
index aca490e287..6c5ce9f84f 100644
--- a/regexec.c
+++ b/regexec.c
@@ -6963,7 +6963,8 @@ S_regmatch(pTHX_ regmatch_info *reginfo, char *startpos, regnode *prog)
PL_op = oop;
PL_curcop = ocurcop;
regcp_restore(rex, runops_cp, &maxopenparen);
- PL_curpm = PL_reg_curpm;
+ PL_curpm_under = PL_curpm;
+ PL_curpm = PL_reg_curpm;
if (logical != 2)
break;
@@ -9532,6 +9533,7 @@ S_setup_eval_state(pTHX_ regmatch_info *const reginfo)
}
SET_reg_curpm(reginfo->prog);
eval_state->curpm = PL_curpm;
+ PL_curpm_under = PL_curpm;
PL_curpm = PL_reg_curpm;
if (RXp_MATCH_COPIED(rex)) {
/* Here is a serious problem: we cannot rewrite subbeg,