From 62e202f7570839975cf57d1dd97a3e011207d300 Mon Sep 17 00:00:00 2001 From: "Philip.Hazel" Date: Sat, 27 May 2017 16:06:56 +0000 Subject: [PATCH] Discard partial match when endanchored is set in the fuzzer, as it just gives an immediate bad options return. --- ChangeLog | 1 - src/pcre2_fuzzsupport.c | 10 ++++++++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 942b360..4f42b7e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -42,7 +42,6 @@ bugs were never in fully released code, but are noted here for the record. (g) Similarly refactor the way the variable length ovector is addressed for similar reasons. Fixes oss-fuzz issue 1465. - 2. Now that pcre2_match() no longer uses recursive function calls (see above), the "match limit recursion" value seems misnamed. It still exists, and limits the depth of tree that is searched. To avoid future confusion, it has been diff --git a/src/pcre2_fuzzsupport.c b/src/pcre2_fuzzsupport.c index 03d5ef9..7e0d550 100644 --- a/src/pcre2_fuzzsupport.c +++ b/src/pcre2_fuzzsupport.c @@ -85,14 +85,20 @@ r2 = rand(); and also that PCRE2_NO_UTF_CHECK is unset, as there is no guarantee that the input is UTF-8. Also unset PCRE2_NEVER_UTF and PCRE2_NEVER_UCP as there is no reason to disallow UTF and UCP. Force PCRE2_NEVER_BACKSLASH_C to be set because -\C in random patterns is highly likely to cause a crash. */ +\C in random patterns is highly likely to cause a crash. */ compile_options = ((((uint32_t)r1 << 16) | ((uint32_t)r2 & 0xffff)) & ALLOWED_COMPILE_OPTIONS) | PCRE2_NEVER_BACKSLASH_C; - + match_options = ((((uint32_t)r1 << 16) | ((uint32_t)r2 & 0xffff)) & ALLOWED_MATCH_OPTIONS); + +/* Discard partial matching if PCRE2_ENDANCHORED is set, because they are not +allowed together and just give an immediate error return. */ + +if (((compile_options|match_options) & PCRE2_ENDANCHORED) != 0) + match_options &= ~(PCRE2_PARTIAL_HARD|PCRE2_PARTIAL_SOFT); /* Do the compile with and without the options, and after a successful compile, likewise do the match with and without the options. */