Fix mutual recursion inside other parentheses stack overflow bug.
This commit is contained in:
parent
cd85fae3c6
commit
6b6e611b39
|
@ -37,6 +37,10 @@ interacting badly with the code for computing the amount of space needed to
|
||||||
compile the pattern, leading to a buffer overflow. This bug was discovered by
|
compile the pattern, leading to a buffer overflow. This bug was discovered by
|
||||||
the LLVM fuzzer.
|
the LLVM fuzzer.
|
||||||
|
|
||||||
|
10. A pattern such as /((?2)+)((?1))/ which has mutual recursion nested inside
|
||||||
|
other kinds of group caused stack overflow at compile time. This bug was
|
||||||
|
discovered by the LLVM fuzzer.
|
||||||
|
|
||||||
|
|
||||||
Version 10.10 06-March-2015
|
Version 10.10 06-March-2015
|
||||||
---------------------------
|
---------------------------
|
||||||
|
|
|
@ -1331,8 +1331,8 @@ for (code = first_significant_code(code + PRIV(OP_lengths)[*code], TRUE);
|
||||||
empty_branch = FALSE;
|
empty_branch = FALSE;
|
||||||
do
|
do
|
||||||
{
|
{
|
||||||
if (!empty_branch && could_be_empty_branch(code, endcode, utf, cb, NULL))
|
if (!empty_branch && could_be_empty_branch(code, endcode, utf, cb,
|
||||||
empty_branch = TRUE;
|
recurses)) empty_branch = TRUE;
|
||||||
code += GET(code, 1);
|
code += GET(code, 1);
|
||||||
}
|
}
|
||||||
while (*code == OP_ALT);
|
while (*code == OP_ALT);
|
||||||
|
|
|
@ -4236,4 +4236,9 @@ a random value. /Ix
|
||||||
** Failers
|
** Failers
|
||||||
aaa
|
aaa
|
||||||
|
|
||||||
|
# JIT gives a different error message for the infinite recursion
|
||||||
|
|
||||||
|
"(*NO_JIT)((?2)+)((?1)){"
|
||||||
|
abcd{
|
||||||
|
|
||||||
# End of testinput2
|
# End of testinput2
|
||||||
|
|
|
@ -14198,4 +14198,10 @@ No match
|
||||||
aaa
|
aaa
|
||||||
No match
|
No match
|
||||||
|
|
||||||
|
# JIT gives a different error message for the infinite recursion
|
||||||
|
|
||||||
|
"(*NO_JIT)((?2)+)((?1)){"
|
||||||
|
abcd{
|
||||||
|
Failed: error -52: nested recursion at the same subject position
|
||||||
|
|
||||||
# End of testinput2
|
# End of testinput2
|
||||||
|
|
Loading…
Reference in New Issue