diff --git a/ChangeLog b/ChangeLog index 130afaa..66350b9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -288,6 +288,8 @@ a factor of the size of the compiling workspace (it currently is). 84. Test for error code <= 0 in regerror(). +85. Check for too many replacements (more than INT_MAX) in pcre2_substitute(). + Version 10.20 30-June-2015 -------------------------- diff --git a/src/pcre2.h b/src/pcre2.h index 43440ef..cd23e95 100644 --- a/src/pcre2.h +++ b/src/pcre2.h @@ -241,6 +241,7 @@ numbers must not be changed. */ #define PCRE2_ERROR_REPMISSINGBRACE (-58) #define PCRE2_ERROR_BADSUBSTITUTION (-59) #define PCRE2_ERROR_BADSUBSPATTERN (-60) +#define PCRE2_ERROR_TOOMANYREPLACE (-61) /* Request types for pcre2_pattern_info() */ diff --git a/src/pcre2.h.in b/src/pcre2.h.in index 260c61c..0e8e932 100644 --- a/src/pcre2.h.in +++ b/src/pcre2.h.in @@ -241,6 +241,7 @@ numbers must not be changed. */ #define PCRE2_ERROR_REPMISSINGBRACE (-58) #define PCRE2_ERROR_BADSUBSTITUTION (-59) #define PCRE2_ERROR_BADSUBSPATTERN (-60) +#define PCRE2_ERROR_TOOMANYREPLACE (-61) /* Request types for pcre2_pattern_info() */ diff --git a/src/pcre2_error.c b/src/pcre2_error.c index e597b75..0aa108e 100644 --- a/src/pcre2_error.c +++ b/src/pcre2_error.c @@ -251,6 +251,7 @@ static const char match_error_texts[] = "bad substitution in replacement string\0" /* 60 */ "match with end before start is not supported\0" + "too many replacements (more than INT_MAX)\0" ; diff --git a/src/pcre2_substitute.c b/src/pcre2_substitute.c index b861ba5..9ece6f6 100644 --- a/src/pcre2_substitute.c +++ b/src/pcre2_substitute.c @@ -329,6 +329,17 @@ do goto EXIT; } + /* Paranoid check for integer overflow; surely no real call to this function + would ever hit this! */ + + if (subs == INT_MAX) + { + rc = PCRE2_ERROR_TOOMANYREPLACE; + goto EXIT; + } + + /* Count substitutions and proceed */ + subs++; if (rc == 0) rc = ovector_count; fraglength = ovector[0] - start_offset;