diff options
author | Yves Orton <demerphq@gmail.com> | 2016-10-31 20:22:37 +0100 |
---|---|---|
committer | Yves Orton <demerphq@gmail.com> | 2016-11-01 13:29:48 +0100 |
commit | 5585e758ec847fcd75936b77096edf5234d6e0c0 (patch) | |
tree | 1067e5d69b4a4ffc029abad8b9afce586b5aa91e /regexec.c | |
parent | 27deb0cf05ad74bec9ea0da3d1b6405346a66401 (diff) | |
download | perl-5585e758ec847fcd75936b77096edf5234d6e0c0.tar.gz |
rework perl #129903 - inf recursion from use of empty pattern in regex codeblock
FC didn't like my previous patch for this issue, so here is the
one he likes better. With tests and etc. :-)
The basic problem is that code like this: /(?{ s!!! })/ can trigger
infinite recursion on the C stack (not the normal perl stack) when the
last successful pattern in scope is itself. Since the C stack overflows
this manifests as an untrappable error/segfault, which then kills perl.
We avoid the segfault by simply forbidding the use of the empty pattern
when it would resolve to the currently executing pattern.
I imagine with a bit of effort someone can trigger the original SEGV,
unlike my original fix which forbade use of the empty pattern in a
regex code block. So if someone actually reports such a bug we might
have to revert to the older approach of prohibiting this.
Diffstat (limited to 'regexec.c')
-rw-r--r-- | regexec.c | 4 |
1 files changed, 3 insertions, 1 deletions
@@ -6963,7 +6963,8 @@ S_regmatch(pTHX_ regmatch_info *reginfo, char *startpos, regnode *prog) PL_op = oop; PL_curcop = ocurcop; regcp_restore(rex, runops_cp, &maxopenparen); - PL_curpm = PL_reg_curpm; + PL_curpm_under = PL_curpm; + PL_curpm = PL_reg_curpm; if (logical != 2) break; @@ -9532,6 +9533,7 @@ S_setup_eval_state(pTHX_ regmatch_info *const reginfo) } SET_reg_curpm(reginfo->prog); eval_state->curpm = PL_curpm; + PL_curpm_under = PL_curpm; PL_curpm = PL_reg_curpm; if (RXp_MATCH_COPIED(rex)) { /* Here is a serious problem: we cannot rewrite subbeg, |