diff options
| author | Nikita Popov <nikita.ppv@gmail.com> | 2019-10-07 13:21:36 +0200 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2019-10-07 13:23:56 +0200 |
| commit | ab61d5caf926e080fb5729dbef9ae091169cec88 (patch) | |
| tree | 2c995d02388160b5fd7dcd588e5cfd3d31a2351c /ext/pcre | |
| parent | 3322c78a889e278b738b2c483b4d09d0a9127369 (diff) | |
| download | php-git-ab61d5caf926e080fb5729dbef9ae091169cec88.tar.gz | |
Backport fix for uaf during pcre jit fallback
Backports parts of https://vcs.pcre.org/pcre2?view=revision&revision=1175
fixing https://bugs.exim.org/show_bug.cgi?id=2453.
Diffstat (limited to 'ext/pcre')
| -rw-r--r-- | ext/pcre/pcre2lib/pcre2_jit_compile.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/ext/pcre/pcre2lib/pcre2_jit_compile.c b/ext/pcre/pcre2lib/pcre2_jit_compile.c index c491be2917..6c317b68d1 100644 --- a/ext/pcre/pcre2lib/pcre2_jit_compile.c +++ b/ext/pcre/pcre2lib/pcre2_jit_compile.c @@ -12321,7 +12321,7 @@ if (SLJIT_UNLIKELY(sljit_get_compiler_error(compiler))) sljit_free_compiler(compiler); SLJIT_FREE(common->optimized_cbracket, allocator_data); SLJIT_FREE(common->private_data_ptrs, allocator_data); - PRIV(jit_free_rodata)(common->read_only_data_head, compiler->allocator_data); + PRIV(jit_free_rodata)(common->read_only_data_head, allocator_data); return PCRE2_ERROR_NOMEMORY; } @@ -12375,7 +12375,7 @@ if (SLJIT_UNLIKELY(sljit_get_compiler_error(compiler))) sljit_free_compiler(compiler); SLJIT_FREE(common->optimized_cbracket, allocator_data); SLJIT_FREE(common->private_data_ptrs, allocator_data); - PRIV(jit_free_rodata)(common->read_only_data_head, compiler->allocator_data); + PRIV(jit_free_rodata)(common->read_only_data_head, allocator_data); return PCRE2_ERROR_NOMEMORY; } @@ -12464,7 +12464,7 @@ while (common->currententry != NULL) sljit_free_compiler(compiler); SLJIT_FREE(common->optimized_cbracket, allocator_data); SLJIT_FREE(common->private_data_ptrs, allocator_data); - PRIV(jit_free_rodata)(common->read_only_data_head, compiler->allocator_data); + PRIV(jit_free_rodata)(common->read_only_data_head, allocator_data); return PCRE2_ERROR_NOMEMORY; } flush_stubs(common); @@ -12589,7 +12589,7 @@ while (label_addr != NULL) sljit_free_compiler(compiler); if (executable_func == NULL) { - PRIV(jit_free_rodata)(common->read_only_data_head, compiler->allocator_data); + PRIV(jit_free_rodata)(common->read_only_data_head, allocator_data); return PCRE2_ERROR_NOMEMORY; } @@ -12604,7 +12604,7 @@ else /* This case is highly unlikely since we just recently freed a lot of memory. Not impossible though. */ sljit_free_code(executable_func); - PRIV(jit_free_rodata)(common->read_only_data_head, compiler->allocator_data); + PRIV(jit_free_rodata)(common->read_only_data_head, allocator_data); return PCRE2_ERROR_NOMEMORY; } memset(functions, 0, sizeof(executable_functions)); |