302 lines
9.7 KiB
Diff
302 lines
9.7 KiB
Diff
Index: source/i18n/regexcmp.cpp
|
|
===================================================================
|
|
--- source/i18n/regexcmp.cpp (revision 23291)
|
|
+++ source/i18n/regexcmp.cpp (revision 23292)
|
|
@@ -1186,14 +1186,17 @@
|
|
// Because capture groups can be forward-referenced by back-references,
|
|
// we fill the operand with the capture group number. At the end
|
|
// of compilation, it will be changed to the variable's location.
|
|
- U_ASSERT(groupNum > 0);
|
|
- int32_t op;
|
|
- if (fModeFlags & UREGEX_CASE_INSENSITIVE) {
|
|
- op = URX_BUILD(URX_BACKREF_I, groupNum);
|
|
+ if (groupNum < 1) {
|
|
+ error(U_REGEX_INVALID_BACK_REF);
|
|
} else {
|
|
- op = URX_BUILD(URX_BACKREF, groupNum);
|
|
+ int32_t op;
|
|
+ if (fModeFlags & UREGEX_CASE_INSENSITIVE) {
|
|
+ op = URX_BUILD(URX_BACKREF_I, groupNum);
|
|
+ } else {
|
|
+ op = URX_BUILD(URX_BACKREF, groupNum);
|
|
+ }
|
|
+ fRXPat->fCompiledPat->addElement(op, *fStatus);
|
|
}
|
|
- fRXPat->fCompiledPat->addElement(op, *fStatus);
|
|
}
|
|
break;
|
|
|
|
Index: source/i18n/rematch.cpp
|
|
===================================================================
|
|
--- source/i18n/rematch.cpp (revision 23291)
|
|
+++ source/i18n/rematch.cpp (revision 23292)
|
|
@@ -30,6 +30,15 @@
|
|
|
|
U_NAMESPACE_BEGIN
|
|
|
|
+// Limit the size of the back track stack, to avoid system failures caused
|
|
+// by heap exhaustion. Units are in 32 bit words, not bytes.
|
|
+// This value puts ICU's limits higher than most other regexp implementations,
|
|
+// which use recursion rather than the heap, and take more storage per
|
|
+// backtrack point.
|
|
+// This constant is _temporary_. Proper API to control the value will added.
|
|
+//
|
|
+static const int32_t BACKTRACK_STACK_CAPACITY = 8000000;
|
|
+
|
|
//-----------------------------------------------------------------------------
|
|
//
|
|
// Constructor and Destructor
|
|
@@ -53,8 +62,9 @@
|
|
}
|
|
if (fStack == NULL || fData == NULL) {
|
|
fDeferredStatus = U_MEMORY_ALLOCATION_ERROR;
|
|
+ } else {
|
|
+ fStack->setMaxCapacity(BACKTRACK_STACK_CAPACITY);
|
|
}
|
|
-
|
|
reset(RegexStaticSets::gStaticSets->fEmptyString);
|
|
}
|
|
|
|
@@ -78,6 +88,8 @@
|
|
}
|
|
if (fStack == NULL || fData == NULL) {
|
|
status = U_MEMORY_ALLOCATION_ERROR;
|
|
+ } else {
|
|
+ fStack->setMaxCapacity(BACKTRACK_STACK_CAPACITY);
|
|
}
|
|
reset(input);
|
|
}
|
|
@@ -102,6 +114,8 @@
|
|
}
|
|
if (fStack == NULL || fData == NULL) {
|
|
status = U_MEMORY_ALLOCATION_ERROR;
|
|
+ } else {
|
|
+ fStack->setMaxCapacity(BACKTRACK_STACK_CAPACITY);
|
|
}
|
|
reset(RegexStaticSets::gStaticSets->fEmptyString);
|
|
}
|
|
@@ -1014,6 +1028,14 @@
|
|
inline REStackFrame *RegexMatcher::StateSave(REStackFrame *fp, int32_t savePatIdx, int32_t frameSize, UErrorCode &status) {
|
|
// push storage for a new frame.
|
|
int32_t *newFP = fStack->reserveBlock(frameSize, status);
|
|
+ if (newFP == NULL) {
|
|
+ // Heap allocation error on attempted stack expansion.
|
|
+ // We need to return a writable stack frame, so just return the
|
|
+ // previous frame. The match operation will stop quickly
|
|
+ // becuase of the error status, after which the frame will never
|
|
+ // be looked at again.
|
|
+ return fp;
|
|
+ }
|
|
fp = (REStackFrame *)(newFP - frameSize); // in case of realloc of stack.
|
|
|
|
// New stack frame = copy of old top frame.
|
|
@@ -1029,8 +1051,8 @@
|
|
fp->fPatIdx = savePatIdx;
|
|
return (REStackFrame *)newFP;
|
|
}
|
|
-
|
|
-
|
|
+
|
|
+
|
|
//--------------------------------------------------------------------------------
|
|
//
|
|
// MatchAt This is the actual matching engine.
|
|
@@ -2261,6 +2283,7 @@
|
|
}
|
|
|
|
if (U_FAILURE(status)) {
|
|
+ isMatch = FALSE;
|
|
break;
|
|
}
|
|
}
|
|
Index: source/test/intltest/regextst.h
|
|
===================================================================
|
|
--- source/test/intltest/regextst.h (revision 23291)
|
|
+++ source/test/intltest/regextst.h (revision 23292)
|
|
@@ -30,6 +30,7 @@
|
|
virtual void Extended();
|
|
virtual void Errors();
|
|
virtual void PerlTests();
|
|
+ virtual void Bug6149();
|
|
|
|
// The following functions are internal to the regexp tests.
|
|
virtual UBool doRegexLMTest(const char *pat, const char *text, UBool looking, UBool match, int32_t line);
|
|
Index: source/test/intltest/regextst.cpp
|
|
===================================================================
|
|
--- source/test/intltest/regextst.cpp (revision 23291)
|
|
+++ source/test/intltest/regextst.cpp (revision 23292)
|
|
@@ -66,6 +66,10 @@
|
|
case 6: name = "PerlTests";
|
|
if (exec) PerlTests();
|
|
break;
|
|
+ case 7: name = "Bug 6149";
|
|
+ if (exec) Bug6149();
|
|
+ break;
|
|
+
|
|
|
|
|
|
default: name = "";
|
|
@@ -1639,6 +1643,12 @@
|
|
|
|
// Ticket 5389
|
|
REGEX_ERR("*c", 1, 1, U_REGEX_RULE_SYNTAX);
|
|
+
|
|
+ // Invalid Back Reference \0
|
|
+ // For ICU 3.8 and earlier
|
|
+ // For ICU versions newer than 3.8, \0 introduces an octal escape.
|
|
+ //
|
|
+ REGEX_ERR("(ab)\\0", 1, 6, U_REGEX_INVALID_BACK_REF);
|
|
|
|
}
|
|
|
|
@@ -2122,6 +2132,26 @@
|
|
}
|
|
|
|
|
|
+//--------------------------------------------------------------
|
|
+//
|
|
+// Bug6149 Verify limits to heap expansion for backtrack stack.
|
|
+// Use this pattern,
|
|
+// "(a?){1,}"
|
|
+// The zero-length match will repeat forever.
|
|
+// (That this goes into a loop is another bug)
|
|
+//
|
|
+//---------------------------------------------------------------
|
|
+void RegexTest::Bug6149() {
|
|
+ UnicodeString pattern("(a?){1,}");
|
|
+ UnicodeString s("xyz");
|
|
+ uint32_t flags = 0;
|
|
+ UErrorCode status = U_ZERO_ERROR;
|
|
+
|
|
+ RegexMatcher matcher(pattern, s, flags, status);
|
|
+ UBool result = false;
|
|
+ REGEX_ASSERT_FAIL(result=matcher.matches(status), U_BUFFER_OVERFLOW_ERROR);
|
|
+ REGEX_ASSERT(result == FALSE);
|
|
+ }
|
|
|
|
#endif /* !UCONFIG_NO_REGULAR_EXPRESSIONS */
|
|
|
|
Index: source/common/uvectr32.cpp
|
|
===================================================================
|
|
--- source/common/uvectr32.cpp (revision 23291)
|
|
+++ source/common/uvectr32.cpp (revision 23292)
|
|
@@ -26,6 +26,7 @@
|
|
UVector32::UVector32(UErrorCode &status) :
|
|
count(0),
|
|
capacity(0),
|
|
+ maxCapacity(0),
|
|
elements(NULL)
|
|
{
|
|
_init(DEFUALT_CAPACITY, status);
|
|
@@ -34,6 +35,7 @@
|
|
UVector32::UVector32(int32_t initialCapacity, UErrorCode &status) :
|
|
count(0),
|
|
capacity(0),
|
|
+ maxCapacity(0),
|
|
elements(0)
|
|
{
|
|
_init(initialCapacity, status);
|
|
@@ -46,6 +48,9 @@
|
|
if (initialCapacity < 1) {
|
|
initialCapacity = DEFUALT_CAPACITY;
|
|
}
|
|
+ if (maxCapacity>0 && maxCapacity<initialCapacity) {
|
|
+ initialCapacity = maxCapacity;
|
|
+ }
|
|
elements = (int32_t *)uprv_malloc(sizeof(int32_t)*initialCapacity);
|
|
if (elements == 0) {
|
|
status = U_MEMORY_ALLOCATION_ERROR;
|
|
@@ -189,24 +194,38 @@
|
|
UBool UVector32::expandCapacity(int32_t minimumCapacity, UErrorCode &status) {
|
|
if (capacity >= minimumCapacity) {
|
|
return TRUE;
|
|
- } else {
|
|
- int32_t newCap = capacity * 2;
|
|
- if (newCap < minimumCapacity) {
|
|
- newCap = minimumCapacity;
|
|
- }
|
|
- int32_t* newElems = (int32_t *)uprv_malloc(sizeof(int32_t)*newCap);
|
|
- if (newElems == 0) {
|
|
- status = U_MEMORY_ALLOCATION_ERROR;
|
|
- return FALSE;
|
|
- }
|
|
- uprv_memcpy(newElems, elements, sizeof(elements[0]) * count);
|
|
- uprv_free(elements);
|
|
- elements = newElems;
|
|
- capacity = newCap;
|
|
- return TRUE;
|
|
}
|
|
+ if (maxCapacity>0 && minimumCapacity>maxCapacity) {
|
|
+ status = U_BUFFER_OVERFLOW_ERROR;
|
|
+ return FALSE;
|
|
+ }
|
|
+ int32_t newCap = capacity * 2;
|
|
+ if (newCap < minimumCapacity) {
|
|
+ newCap = minimumCapacity;
|
|
+ }
|
|
+ if (maxCapacity > 0 && newCap > maxCapacity) {
|
|
+ newCap = maxCapacity;
|
|
+ }
|
|
+ int32_t* newElems = (int32_t *)uprv_malloc(sizeof(int32_t)*newCap);
|
|
+ if (newElems == 0) {
|
|
+ status = U_MEMORY_ALLOCATION_ERROR;
|
|
+ return FALSE;
|
|
+ }
|
|
+ uprv_memcpy(newElems, elements, sizeof(elements[0]) * count);
|
|
+ uprv_free(elements);
|
|
+ elements = newElems;
|
|
+ capacity = newCap;
|
|
+ return TRUE;
|
|
}
|
|
|
|
+void UVector32::setMaxCapacity(int32_t limit) {
|
|
+ U_ASSERT(limit >= 0);
|
|
+ maxCapacity = limit;
|
|
+ if (maxCapacity < 0) {
|
|
+ maxCapacity = 0;
|
|
+ }
|
|
+}
|
|
+
|
|
/**
|
|
* Change the size of this vector as follows: If newSize is smaller,
|
|
* then truncate the array, possibly deleting held elements for i >=
|
|
Index: source/common/uvectr32.h
|
|
===================================================================
|
|
--- source/common/uvectr32.h (revision 23291)
|
|
+++ source/common/uvectr32.h (revision 23292)
|
|
@@ -61,6 +61,8 @@
|
|
int32_t count;
|
|
|
|
int32_t capacity;
|
|
+
|
|
+ int32_t maxCapacity; // Limit beyond which capacity is not permitted to grow.
|
|
|
|
int32_t* elements;
|
|
|
|
@@ -162,6 +164,14 @@
|
|
int32_t *getBuffer() const;
|
|
|
|
/**
|
|
+ * Set the maximum allowed buffer capacity for this vector/stack.
|
|
+ * Default with no limit set is unlimited, go until malloc() fails.
|
|
+ * A Limit of zero means unlimited capacity.
|
|
+ * Units are vector elements (32 bits each), not bytes.
|
|
+ */
|
|
+ void setMaxCapacity(int32_t limit);
|
|
+
|
|
+ /**
|
|
* ICU "poor man's RTTI", returns a UClassID for this class.
|
|
*/
|
|
static UClassID U_EXPORT2 getStaticClassID();
|
|
@@ -221,7 +231,9 @@
|
|
}
|
|
|
|
inline int32_t *UVector32::reserveBlock(int32_t size, UErrorCode &status) {
|
|
- ensureCapacity(count+size, status);
|
|
+ if (ensureCapacity(count+size, status) == FALSE) {
|
|
+ return NULL;
|
|
+ }
|
|
int32_t *rp = elements+count;
|
|
count += size;
|
|
return rp;
|