Fix some numerical checking bugs, Bugzilla 2690.
This commit is contained in:
Philip.Hazel
parent
166e576f91
commit
8144ae04e9
|
|
@ -16,6 +16,15 @@ but I have put in a check in order to get rid of the compiler error.
|
|||
3. An alternative patch for CMakeLists.txt because 10.36 # 4 breaks CMake on
|
||||
Windows. Patch from email@cs-ware.de fixes bugzilla #2688.
|
||||
|
||||
4. Two bugs related to over-large numbers have been fixed so the behaviour is
|
||||
now the same as Perl.
|
||||
|
||||
(a) A pattern such as /\214748364/ gave an overflow error instead of being
|
||||
treated as the octal number \214 followed by literal digits.
|
||||
|
||||
(b) A sequence such as {65536 that has no terminating } so is not a
|
||||
quantifier was nevertheless complaining that a quantifier number was too big.
|
||||
|
||||
|
||||
Version 10.36 04-December-2020
|
||||
------------------------------
|
||||
|
|
|
|||
|
|
@ -1398,32 +1398,47 @@ static BOOL
|
|||
read_repeat_counts(PCRE2_SPTR *ptrptr, PCRE2_SPTR ptrend, uint32_t *minp,
|
||||
uint32_t *maxp, int *errorcodeptr)
|
||||
{
|
||||
PCRE2_SPTR p = *ptrptr;
|
||||
PCRE2_SPTR p;
|
||||
BOOL yield = FALSE;
|
||||
BOOL had_comma = FALSE;
|
||||
int32_t min = 0;
|
||||
int32_t max = REPEAT_UNLIMITED; /* This value is larger than MAX_REPEAT_COUNT */
|
||||
|
||||
/* NB read_number() initializes the error code to zero. The only error is for a
|
||||
number that is too big. */
|
||||
/* Check the syntax */
|
||||
|
||||
*errorcodeptr = 0;
|
||||
for (p = *ptrptr;; p++)
|
||||
{
|
||||
uint32_t c;
|
||||
if (p >= ptrend) return FALSE;
|
||||
c = *p;
|
||||
if (IS_DIGIT(c)) continue;
|
||||
if (c == CHAR_RIGHT_CURLY_BRACKET) break;
|
||||
if (c == CHAR_COMMA)
|
||||
{
|
||||
if (had_comma) return FALSE;
|
||||
had_comma = TRUE;
|
||||
}
|
||||
else return FALSE;
|
||||
}
|
||||
|
||||
/* The only error from read_number() is for a number that is too big. */
|
||||
|
||||
p = *ptrptr;
|
||||
if (!read_number(&p, ptrend, -1, MAX_REPEAT_COUNT, ERR5, &min, errorcodeptr))
|
||||
goto EXIT;
|
||||
|
||||
if (p >= ptrend) goto EXIT;
|
||||
|
||||
if (*p == CHAR_RIGHT_CURLY_BRACKET)
|
||||
{
|
||||
p++;
|
||||
max = min;
|
||||
}
|
||||
|
||||
else
|
||||
{
|
||||
if (*p++ != CHAR_COMMA || p >= ptrend) goto EXIT;
|
||||
if (*p != CHAR_RIGHT_CURLY_BRACKET)
|
||||
if (*(++p) != CHAR_RIGHT_CURLY_BRACKET)
|
||||
{
|
||||
if (!read_number(&p, ptrend, -1, MAX_REPEAT_COUNT, ERR5, &max,
|
||||
errorcodeptr) || p >= ptrend || *p != CHAR_RIGHT_CURLY_BRACKET)
|
||||
errorcodeptr))
|
||||
goto EXIT;
|
||||
if (max < min)
|
||||
{
|
||||
|
|
@ -1438,11 +1453,10 @@ yield = TRUE;
|
|||
if (minp != NULL) *minp = (uint32_t)min;
|
||||
if (maxp != NULL) *maxp = (uint32_t)max;
|
||||
|
||||
/* Update the pattern pointer on success, or after an error, but not when
|
||||
the result is "not a repeat quantifier". */
|
||||
/* Update the pattern pointer */
|
||||
|
||||
EXIT:
|
||||
if (yield || *errorcodeptr != 0) *ptrptr = p;
|
||||
*ptrptr = p;
|
||||
return yield;
|
||||
}
|
||||
|
||||
|
|
@ -1776,19 +1790,23 @@ else
|
|||
{
|
||||
oldptr = ptr;
|
||||
ptr--; /* Back to the digit */
|
||||
if (!read_number(&ptr, ptrend, -1, INT_MAX/10 - 1, ERR61, &s,
|
||||
errorcodeptr))
|
||||
break;
|
||||
|
||||
/* \1 to \9 are always back references. \8x and \9x are too; \1x to \7x
|
||||
/* As we know we are at a digit, the only possible error from
|
||||
read_number() is a number that is too large to be a group number. In this
|
||||
case we fall through handle this as not a group reference. If we have
|
||||
read a small enough number, check for a back reference.
|
||||
|
||||
\1 to \9 are always back references. \8x and \9x are too; \1x to \7x
|
||||
are octal escapes if there are not that many previous captures. */
|
||||
|
||||
if (s < 10 || oldptr[-1] >= CHAR_8 || s <= (int)cb->bracount)
|
||||
if (read_number(&ptr, ptrend, -1, INT_MAX/10 - 1, 0, &s, errorcodeptr) &&
|
||||
(s < 10 || oldptr[-1] >= CHAR_8 || s <= (int)cb->bracount))
|
||||
{
|
||||
if (s > (int)MAX_GROUP_NUMBER) *errorcodeptr = ERR61;
|
||||
else escape = -s; /* Indicates a back reference */
|
||||
break;
|
||||
}
|
||||
|
||||
ptr = oldptr; /* Put the pointer back and fall through */
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -6420,4 +6420,13 @@ ef) x/x,mark
|
|||
/(?(DEFINE)(?<foo>bar))(?<![-a-z0-9])word/
|
||||
word
|
||||
|
||||
/a{1,2,3}b/
|
||||
a{1,2,3}b
|
||||
|
||||
/\214748364/
|
||||
>\x{8c}748364<
|
||||
|
||||
/a{65536/
|
||||
>a{65536<
|
||||
|
||||
# End of testinput1
|
||||
|
|
|
|||
|
|
@ -368,4 +368,7 @@
|
|||
ab˙Az
|
||||
ab\x{80000041}z
|
||||
|
||||
/(?i:A{1,}\6666666666)/
|
||||
A\x{1b6}6666666
|
||||
|
||||
# End of testinput11
|
||||
|
|
|
|||
|
|
@ -2189,8 +2189,6 @@
|
|||
|
||||
/a(*MARK)b/
|
||||
|
||||
/(?i:A{1,}\6666666666)/
|
||||
|
||||
/\g6666666666/
|
||||
|
||||
/[\g6666666666]/B
|
||||
|
|
|
|||
|
|
@ -260,4 +260,7 @@
|
|||
|
||||
/(*:*++++++++++++''''''''''''''''''''+''+++'+++x+++++++++++++++++++++++++++++++++++(++++++++++++++++++++:++++++%++:''''''''''''''''''''''''+++++++++++++++++++++++++++++++++++++++++++++++++++++-++++++++k+++++++''''+++'+++++++++++++++++++++++''''++++++++++++':ƿ)/
|
||||
|
||||
/(?i:A{1,}\6666666666)/
|
||||
A\x{1b6}6666666
|
||||
|
||||
# End of testinput9
|
||||
|
|
|
|||
|
|
@ -10176,4 +10176,16 @@ No match
|
|||
word
|
||||
0: word
|
||||
|
||||
/a{1,2,3}b/
|
||||
a{1,2,3}b
|
||||
0: a{1,2,3}b
|
||||
|
||||
/\214748364/
|
||||
>\x{8c}748364<
|
||||
0: \x8c748364
|
||||
|
||||
/a{65536/
|
||||
>a{65536<
|
||||
0: a{65536
|
||||
|
||||
# End of testinput1
|
||||
|
|
|
|||
|
|
@ -661,4 +661,8 @@ Subject length lower bound = 1
|
|||
ab˙Az
|
||||
ab\x{80000041}z
|
||||
|
||||
/(?i:A{1,}\6666666666)/
|
||||
A\x{1b6}6666666
|
||||
0: A\x{1b6}6666666
|
||||
|
||||
# End of testinput11
|
||||
|
|
|
|||
|
|
@ -667,4 +667,8 @@ Subject length lower bound = 1
|
|||
ab\x{80000041}z
|
||||
0: ab\x{80000041}z
|
||||
|
||||
/(?i:A{1,}\6666666666)/
|
||||
A\x{1b6}6666666
|
||||
0: A\x{1b6}6666666
|
||||
|
||||
# End of testinput11
|
||||
|
|
|
|||
|
|
@ -8374,9 +8374,6 @@ No match
|
|||
/a(*MARK)b/
|
||||
Failed: error 166 at offset 7: (*MARK) must have an argument
|
||||
|
||||
/(?i:A{1,}\6666666666)/
|
||||
Failed: error 161 at offset 19: subpattern number is too big
|
||||
|
||||
/\g6666666666/
|
||||
Failed: error 161 at offset 7: subpattern number is too big
|
||||
|
||||
|
|
|
|||
|
|
@ -367,4 +367,8 @@ Failed: error 134 at offset 14: character code point value in \x{} or \o{} is to
|
|||
/(*:*++++++++++++''''''''''''''''''''+''+++'+++x+++++++++++++++++++++++++++++++++++(++++++++++++++++++++:++++++%++:''''''''''''''''''''''''+++++++++++++++++++++++++++++++++++++++++++++++++++++-++++++++k+++++++''''+++'+++++++++++++++++++++++''''++++++++++++':ƿ)/
|
||||
Failed: error 176 at offset 259: name is too long in (*MARK), (*PRUNE), (*SKIP), or (*THEN)
|
||||
|
||||
/(?i:A{1,}\6666666666)/
|
||||
Failed: error 151 at offset 13: octal value is greater than \377 in 8-bit non-UTF-8 mode
|
||||
A\x{1b6}6666666
|
||||
|
||||
# End of testinput9
|
||||
|
|
|
|||
Loading…
Reference in New Issue