diff --git a/ChangeLog b/ChangeLog index 7c5b9c4..332b3c2 100644 --- a/ChangeLog +++ b/ChangeLog @@ -353,6 +353,11 @@ was set when the pmatch argument was NULL. It now returns REG_INVARG. pcre2_compile() to misbehave when auto callouts were enabled. This bug was found by the LLVM fuzzer. +106. If both PCRE2_ALT_VERBNAMES and PCRE2_EXTENDED were set, and a (*MARK) or +other verb "name" ended with whitespace immediately before the closing +parenthesis, pcre2_compile() misbehaved. Example: /(*:abc )/, but only when +both those options were set. + Version 10.20 30-June-2015 -------------------------- diff --git a/src/pcre2_compile.c b/src/pcre2_compile.c index 1699835..3e92436 100644 --- a/src/pcre2_compile.c +++ b/src/pcre2_compile.c @@ -3013,15 +3013,14 @@ for (; ptr < cb->end_pattern; ptr++) { if (x == CHAR_RIGHT_PARENTHESIS) break; - /* Skip over comments and whitespace in extended mode. Need a loop to - handle whitespace after a comment. */ + /* Skip over comments and whitespace in extended mode. */ if ((options & PCRE2_EXTENDED) != 0) { - for (;;) - { - while (MAX_255(x) && (cb->ctypes[x] & ctype_space) != 0) x = *(++ptr); - if (x != CHAR_NUMBER_SIGN) break; + PCRE2_SPTR wscptr = ptr; + while (MAX_255(x) && (cb->ctypes[x] & ctype_space) != 0) x = *(++ptr); + if (x == CHAR_NUMBER_SIGN) + { ptr++; while (*ptr != CHAR_NULL) { @@ -3035,9 +3034,15 @@ for (; ptr < cb->end_pattern; ptr++) if (utf) FORWARDCHAR(ptr); #endif } - x = *ptr; /* Either NULL or the char after a newline */ + } + + /* If we have skipped any characters, restart the loop. */ + + if (ptr > wscptr) + { + ptr--; + continue; } - if (ptr >= cb->end_pattern) break; } /* Process escapes */ diff --git a/testdata/testinput2 b/testdata/testinput2 index 19240d2..eb6b9e4 100644 --- a/testdata/testinput2 +++ b/testdata/testinput2 @@ -4702,4 +4702,6 @@ a)"xI /()\Q\E*]/B,auto_callout a[bc]d +/\x8a+f|;T?(*:;.'?`(\xeap ){![^()!y*''C*(?';]{1;(\x08)/B,alt_verbnames,dupnames,extended + # End of testinput2 diff --git a/testdata/testoutput2 b/testdata/testoutput2 index a3aced7..698c44d 100644 --- a/testdata/testoutput2 +++ b/testdata/testoutput2 @@ -14979,4 +14979,23 @@ Subject length lower bound = 0 0: ] 1: +/\x8a+f|;T?(*:;.'?`(\xeap ){![^()!y*''C*(?';]{1;(\x08)/B,alt_verbnames,dupnames,extended +------------------------------------------------------------------ + Bra + \x{8a}++ + f + Alt + ; + T? + *MARK ;.'?`(\x{ea}p + {! + [\x00- "-&+-:<->@-BD-xz-\xff] (neg) + {1; + CBra 1 + \x08 + Ket + Ket + End +------------------------------------------------------------------ + # End of testinput2