walkero
/
pcre2
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

Fix sanitize=undefined warnings for left shifts of 31.

This commit is contained in:
Philip.Hazel 2015-05-16 16:02:46 +00:00
parent 6f94ece67d
commit 472d1c4e62
2 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ChangeLog
View File

@ -123,6 +123,9 @@ This bug was discovered by the LLVM fuzzer.
current group, for example in this pattern: /(?|(\k'Pm')|(?'Pm'))/, caused a
buffer overflow at compile time. This bug was discovered by the LLVM fuzzer.
31. Fix -fsanitize=undefined warnings for left shifts of 1 by 31 (it treats 1
as an int; fixed by writing it as 1u).
Version 10.10 06-March-2015
---------------------------

8
src/pcre2_compile.c
View File

@ -6057,7 +6057,7 @@ for (;; ptr++)
{
open_capitem *oc;
recno = GET2(slot, 0);
cb->backref_map |= (recno < 32)? (1 << recno) : 1;
cb->backref_map |= (recno < 32)? (1u << recno) : 1;
if ((uint32_t)recno > cb->top_backref) cb->top_backref = recno;
/* Check to see if this back reference is recursive, that is, it
@ -6686,7 +6686,7 @@ for (;; ptr++)
item_hwm_offset = cb->hwm - cb->start_workspace;
*code++ = ((options & PCRE2_CASELESS) != 0)? OP_REFI : OP_REF;
PUT2INC(code, 0, recno);
cb->backref_map |= (recno < 32)? (1 << recno) : 1;
cb->backref_map |= (recno < 32)? (1u << recno) : 1;
if ((uint32_t)recno > cb->top_backref) cb->top_backref = recno;
/* Check to see if this back reference is recursive, that it, it
@ -7302,7 +7302,7 @@ do {
op == OP_SCBRA || op == OP_SCBRAPOS)
{
int n = GET2(scode, 1+LINK_SIZE);
int new_map = bracket_map | ((n < 32)? (1 << n) : 1);
int new_map = bracket_map | ((n < 32)? (1u << n) : 1);
if (!is_anchored(scode, new_map, cb, atomcount)) return FALSE;
}
@ -7426,7 +7426,7 @@ do {
op == OP_SCBRA || op == OP_SCBRAPOS)
{
int n = GET2(scode, 1+LINK_SIZE);
int new_map = bracket_map | ((n < 32)? (1 << n) : 1);
int new_map = bracket_map | ((n < 32)? (1u << n) : 1);
if (!is_startline(scode, new_map, cb, atomcount)) return FALSE;
}