walkero
/
pcre2
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

Fix read overflow for invalid VERSION test with one fractional digit at the end 

of a pattern. Fixes ClusterFuzz 23779.
This commit is contained in:
Philip.Hazel 2020-06-29 15:35:49 +00:00
parent ed489f99ae
commit 0ad89ab06d
4 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog
View File

@ -44,6 +44,10 @@ platforms.)
debug Windows builds using CMake. This also updated configure so that it debug Windows builds using CMake. This also updated configure so that it
generates *.pc files and pcre2-config with the same content, as in the past. generates *.pc files and pcre2-config with the same content, as in the past.
8. If a pattern ended with (?(VERSION=n.d where n is any number but d is just a
single digit, the code unit beyond d was being read (i.e. there was a read
buffer overflow). Fixes ClusterFuzz 23779.
Version 10.35 09-May-2020 Version 10.35 09-May-2020
--------------------------- ---------------------------

1
src/pcre2_compile.c
View File

@ -4331,6 +4331,7 @@ while (ptr < ptrend)
{ {
if (++ptr >= ptrend || !IS_DIGIT(*ptr)) goto BAD_VERSION_CONDITION; if (++ptr >= ptrend || !IS_DIGIT(*ptr)) goto BAD_VERSION_CONDITION;
minor = (*ptr++ - CHAR_0) * 10; minor = (*ptr++ - CHAR_0) * 10;
if (ptr >= ptrend) goto BAD_VERSION_CONDITION;
if (IS_DIGIT(*ptr)) minor += *ptr++ - CHAR_0; if (IS_DIGIT(*ptr)) minor += *ptr++ - CHAR_0;
if (ptr >= ptrend || *ptr != CHAR_RIGHT_PARENTHESIS) if (ptr >= ptrend || *ptr != CHAR_RIGHT_PARENTHESIS)
goto BAD_VERSION_CONDITION; goto BAD_VERSION_CONDITION;

2
testdata/testinput2 vendored
View File

@ -5864,4 +5864,6 @@ a)"xI
/"(*MARK:>" 00 "<).(?C1)."/hex,mark,no_start_optimize /"(*MARK:>" 00 "<).(?C1)."/hex,mark,no_start_optimize
AB AB
/(?(VERSION=0.0/
# End of testinput2 # End of testinput2

3
testdata/testoutput2 vendored
View File

@ -17621,6 +17621,9 @@ Latest Mark: >\x00<
0: AB 0: AB
MK: >\x00< MK: >\x00<
/(?(VERSION=0.0/
Failed: error 179 at offset 14: syntax error or number too big in (?(VERSION condition
# End of testinput2 # End of testinput2
Error -70: PCRE2_ERROR_BADDATA (unknown error number) Error -70: PCRE2_ERROR_BADDATA (unknown error number)
Error -62: bad serialized data Error -62: bad serialized data