diff --git a/ChangeLog b/ChangeLog index fe232d8..1a09dba 100644 --- a/ChangeLog +++ b/ChangeLog @@ -306,6 +306,9 @@ In addition, colour settings containing anything other than digits and semicolon are ignored, and the colour controls are no longer output for empty strings. +47. Detecting patterns that are too large inside the length-measuring loop +saves processing ridiculously long patterns to their end. + Version 10.22 29-July-2016 -------------------------- diff --git a/src/pcre2_compile.c b/src/pcre2_compile.c index de4a5b2..374fedf 100644 --- a/src/pcre2_compile.c +++ b/src/pcre2_compile.c @@ -4659,7 +4659,7 @@ for (;; pptr++) meta = META_CODE(*pptr); meta_arg = META_DATA(*pptr); - + /* If we are in the pre-compile phase, accumulate the length used for the previous cycle of this loop, unless the next item is a quantifier. */ @@ -4693,6 +4693,11 @@ for (;; pptr++) return 0; } *lengthptr += (PCRE2_SIZE)(code - orig_code); + if (*lengthptr > MAX_PATTERN_SIZE) + { + *errorcodeptr = ERR20; /* Pattern is too large */ + return 0; + } code = orig_code; } @@ -7334,7 +7339,6 @@ for (;;) } *lengthptr += length; } -// if (lengthptr == NULL) fprintf(stderr, "~~group returns %d\n", okreturn); return okreturn; } @@ -9075,6 +9079,8 @@ code = cworkspace; if (errorcode != 0) goto HAD_CB_ERROR; /* Offset is in cb.erroroffset */ +/* This should be caught in compile_regex(), but just in case... */ + if (length > MAX_PATTERN_SIZE) { errorcode = ERR20;