walkero
/
pcre2
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

Fix off-by-one bug in pcre2_substitute().

This commit is contained in:
Philip.Hazel 2015-11-01 16:36:20 +00:00
parent f72b753f73
commit a0d04b9fa3
2 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ChangeLog
View File

@ -245,6 +245,9 @@ digit was given after the decimal point, or if more than two digits were given.
It now works with one or two digits, and gives a compile time error if more are It now works with one or two digits, and gives a compile time error if more are
given. given.
71. In pcre2_substitute() there was the possibility of reading one code unit
beyond the end of the replacement string.
Version 10.20 30-June-2015 Version 10.20 30-June-2015
-------------------------- --------------------------

4
src/pcre2_substitute.c
View File

@ -427,8 +427,8 @@ do
{ {
name[n++] = next; name[n++] = next;
if (n > 32) goto BAD; if (n > 32) goto BAD;
if (ptr >= repend) break; if (++ptr >= repend) break;
next = *(++ptr); next = *ptr;
} }
if (n == 0) goto BAD; if (n == 0) goto BAD;
name[n] = 0; name[n] = 0;