walkero
/
pcre2
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

Fix diagnosis of negative relative references to non-existent groups.

This commit is contained in:
Philip.Hazel 2015-03-31 15:01:25 +00:00
parent 2327a5860b
commit 6a2cb0d774
4 changed files with 24 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog
View File

@ -55,6 +55,10 @@ a fixed maximum following a group that contains a subroutine reference was
incorrectly compiled and could trigger buffer overflow. This bug was discovered
by the LLVM fuzzer.
14. Negative relative recursive references such as (?-7) to non-existent
subpatterns were not being diagnosed and could lead to unpredictable behaviour.
This bug was discovered by the LLVM fuzzer.
Version 10.10 06-March-2015
---------------------------

20
src/pcre2_compile.c
View File

@ -3179,15 +3179,15 @@ for (;; ptr++)
BOOL xclass_has_prop;
#endif
int newoptions;
uint32_t recno;
int refsign;
int recno; /* Must be signed */
int refsign; /* Must be signed */
int skipbytes;
uint32_t subreqcu, subfirstcu;
int32_t subreqcuflags, subfirstcuflags;
int terminator;
unsigned int mclength;
unsigned int tempbracount;
uint32_t ec;
uint32_t subreqcu, subfirstcu;
int32_t subreqcuflags, subfirstcuflags; /* Must be signed */
PCRE2_UCHAR mcbuffer[8];
/* Get next character in the pattern */
@ -5443,13 +5443,13 @@ for (;; ptr++)
}
if (refsign != 0) recno = (refsign == CHAR_MINUS)?
cb->bracount - recno + 1 : recno + cb->bracount;
if (recno <= 0 || recno > cb->final_bracount)
if (recno <= 0 || (uint32_t)recno > cb->final_bracount)
{
*errorcodeptr = ERR15;
goto FAILED;
}
PUT2(code, 2+LINK_SIZE, recno);
if (recno > cb->top_backref) cb->top_backref = recno;
if ((uint32_t)recno > cb->top_backref) cb->top_backref = recno;
break;
}
@ -5475,7 +5475,7 @@ for (;; ptr++)
for (;;)
{
recno = GET2(slot, 0); /* Number for last found */
if (recno > cb->top_backref) cb->top_backref = recno;
if ((uint32_t)recno > cb->top_backref) cb->top_backref = recno;
count++;
if (++i >= cb->names_found) break;
slot += cb->name_entry_size;
@ -6000,7 +6000,7 @@ for (;; ptr++)
open_capitem *oc;
recno = GET2(slot, 0);
cb->backref_map |= (recno < 32)? (1 << recno) : 1;
if (recno > cb->top_backref) cb->top_backref = recno;
if ((uint32_t)recno > cb->top_backref) cb->top_backref = recno;
/* Check to see if this back reference is recursive, that it, it
is inside the group that it references. A flag is set so that the
@ -6121,7 +6121,7 @@ for (;; ptr++)
if (called == NULL)
{
if (recno > cb->final_bracount)
if ((uint32_t)recno > cb->final_bracount)
{
*errorcodeptr = ERR15;
goto FAILED;
@ -6626,7 +6626,7 @@ for (;; ptr++)
*code++ = ((options & PCRE2_CASELESS) != 0)? OP_REFI : OP_REF;
PUT2INC(code, 0, recno);
cb->backref_map |= (recno < 32)? (1 << recno) : 1;
if (recno > cb->top_backref) cb->top_backref = recno;
if ((uint32_t)recno > cb->top_backref) cb->top_backref = recno;
/* Check to see if this back reference is recursive, that it, it
is inside the group that it references. A flag is set so that the

4
testdata/testinput2 vendored
View File

@ -4249,4 +4249,8 @@ a random value. /Ix
"X((?2)()*+){2}"B
/(?<=\bABQ(3(?-7)))/
/(?<=\bABQ(3(?+7)))/
# End of testinput2

6
testdata/testoutput2 vendored
View File

@ -14251,4 +14251,10 @@ Failed: error 128 at offset 3: assertion expected after (?( or (?(?C)
End
------------------------------------------------------------------
/(?<=\bABQ(3(?-7)))/
Failed: error 115 at offset 15: reference to non-existent subpattern
/(?<=\bABQ(3(?+7)))/
Failed: error 115 at offset 15: reference to non-existent subpattern
# End of testinput2