walkero
/
pcre2
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

Fix OOB error in substitute with start offset longer than length.

This commit is contained in:
Philip.Hazel 2016-12-09 18:19:38 +00:00
parent bcad1aa4f6
commit 7914fa82a9
4 changed files with 17 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ChangeLog
View File

@ -208,6 +208,9 @@ the current pattern or a previous one and a wide character was matched.
PCRE2_SUBSTITUTE_EXTENDED was set caused a segmentation fault (NULL PCRE2_SUBSTITUTE_EXTENDED was set caused a segmentation fault (NULL
dereference). dereference).
33. If the starting offset was specified as greater than the subject length in
a call to pcre2_substitute() an out-of-bounds memory reference could occur.
Version 10.22 29-July-2016 Version 10.22 29-July-2016
-------------------------- --------------------------

8
src/pcre2_substitute.c
View File

@ -130,7 +130,7 @@ for (; ptr < ptrend; ptr++)
ptr += 1; /* Must point after \ */ ptr += 1; /* Must point after \ */
erc = PRIV(check_escape)(&ptr, ptrend, &ch, &errorcode, erc = PRIV(check_escape)(&ptr, ptrend, &ch, &errorcode,
code->overall_options, FALSE, NULL); code->overall_options, FALSE, NULL);
ptr -= 1; /* Back to last code unit of escape */ ptr -= 1; /* Back to last code unit of escape */
if (errorcode != 0) if (errorcode != 0)
{ {
rc = errorcode; rc = errorcode;
@ -289,6 +289,12 @@ options &= ~SUBSTITUTE_OPTIONS;
/* Copy up to the start offset */ /* Copy up to the start offset */
if (start_offset > length)
{
match_data->leftchar = 0;
rc = PCRE2_ERROR_BADOFFSET;
goto EXIT;
}
CHECKMEMCPY(subject, start_offset); CHECKMEMCPY(subject, start_offset);
/* Loop for global substituting. */ /* Loop for global substituting. */

3
testdata/testinput2 vendored
View File

@ -4928,4 +4928,7 @@ a)"xI
/(\x0e00\000000\xc)/replace=\P,substitute_extended /(\x0e00\000000\xc)/replace=\P,substitute_extended
\x0e00\000000\xc \x0e00\000000\xc
//replace=0
\=offset=7
# End of testinput2 # End of testinput2

4
testdata/testoutput2 vendored
View File

@ -15382,6 +15382,10 @@ No match
\x0e00\000000\xc \x0e00\000000\xc
Failed: error -57 at offset 2 in replacement: bad escape sequence in replacement string Failed: error -57 at offset 2 in replacement: bad escape sequence in replacement string
//replace=0
\=offset=7
Failed: error -33: bad offset value
# End of testinput2 # End of testinput2
Error -63: PCRE2_ERROR_BADDATA (unknown error number) Error -63: PCRE2_ERROR_BADDATA (unknown error number)
Error -62: bad serialized data Error -62: bad serialized data