rpms/oniguruma
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2019-19203

Browse Source 
Resolves: RHEL-9510
This commit is contained in:
Vitezslav Crhonek 2023-12-21 10:47:10 +01:00
parent 9dacef57ff
commit 59bb9d31b1
2 changed files with 118 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

114
oniguruma-6.8.2-CVE-2019-19203-fix.patch Normal file
View File

@ -0,0 +1,114 @@
diff -up onig-6.8.2/src/gb18030.c.orig onig-6.8.2/src/gb18030.c
--- onig-6.8.2/src/gb18030.c.orig 2023-10-17 12:12:44.944352236 +0200
+++ onig-6.8.2/src/gb18030.c 2023-10-17 12:14:52.188483869 +0200
@@ -76,6 +76,20 @@ gb18030_mbc_enc_len(const UChar* p)
}
static int
+gb18030_code_to_mbclen(OnigCodePoint code)
+{
+ if ((code & 0xff000000) != 0) return 4;
+ else if ((code & 0xff0000) != 0) return ONIGERR_INVALID_CODE_POINT_VALUE;
+ else if ((code & 0xff00) != 0) return 2;
+ else {
+ if (GB18030_MAP[(int )(code & 0xff)] == CM)
+ return ONIGERR_INVALID_CODE_POINT_VALUE;
+
+ return 1;
+ }
+}
+
+static int
is_valid_mbc_string(const UChar* p, const UChar* end)
{
while (p < end) {
@@ -522,7 +536,7 @@ OnigEncodingType OnigEncodingGB18030 = {
1, /* min enc length */
onigenc_is_mbc_newline_0x0a,
gb18030_mbc_to_code,
- onigenc_mb4_code_to_mbclen,
+ gb18030_code_to_mbclen,
gb18030_code_to_mbc,
gb18030_mbc_case_fold,
onigenc_ascii_apply_all_case_fold,
diff -up onig-6.8.2/src/regparse.c.orig onig-6.8.2/src/regparse.c
--- onig-6.8.2/src/regparse.c.orig 2023-10-17 12:17:56.661666528 +0200
+++ onig-6.8.2/src/regparse.c 2023-10-17 12:29:57.807302184 +0200
@@ -5839,6 +5839,7 @@ add_ctype_to_cc(CClassNode* cc, int ctyp
int c, r;
int ascii_mode;
+ int is_single;
const OnigCodePoint *ranges;
OnigCodePoint limit;
OnigCodePoint sb_out;
@@ -5860,6 +5861,7 @@ add_ctype_to_cc(CClassNode* cc, int ctyp
}
r = 0;
+ is_single = ONIGENC_IS_SINGLEBYTE(enc);
limit = ascii_mode ? ASCII_LIMIT : SINGLE_BYTE_SIZE;
switch (ctype) {
@@ -5876,19 +5878,25 @@ add_ctype_to_cc(CClassNode* cc, int ctyp
case ONIGENC_CTYPE_ALNUM:
if (not != 0) {
for (c = 0; c < (int )limit; c++) {
- if (! ONIGENC_IS_CODE_CTYPE(enc, (OnigCodePoint )c, ctype))
- BITSET_SET_BIT(cc->bs, c);
+ if (is_single != 0 || ONIGENC_CODE_TO_MBCLEN(enc, c) == 1) {
+ if (! ONIGENC_IS_CODE_CTYPE(enc, (OnigCodePoint )c, ctype))
+ BITSET_SET_BIT(cc->bs, c);
+ }
}
for (c = limit; c < SINGLE_BYTE_SIZE; c++) {
- BITSET_SET_BIT(cc->bs, c);
+ if (is_single != 0 || ONIGENC_CODE_TO_MBCLEN(enc, c) == 1)
+ BITSET_SET_BIT(cc->bs, c);
}
- ADD_ALL_MULTI_BYTE_RANGE(enc, cc->mbuf);
+ if (is_single == 0)
+ ADD_ALL_MULTI_BYTE_RANGE(enc, cc->mbuf);
}
else {
for (c = 0; c < (int )limit; c++) {
- if (ONIGENC_IS_CODE_CTYPE(enc, (OnigCodePoint )c, ctype))
- BITSET_SET_BIT(cc->bs, c);
+ if (is_single != 0 || ONIGENC_CODE_TO_MBCLEN(enc, c) == 1) {
+ if (ONIGENC_IS_CODE_CTYPE(enc, (OnigCodePoint )c, ctype))
+ BITSET_SET_BIT(cc->bs, c);
+ }
}
}
break;
@@ -5898,21 +5906,25 @@ add_ctype_to_cc(CClassNode* cc, int ctyp
case ONIGENC_CTYPE_WORD:
if (not != 0) {
for (c = 0; c < (int )limit; c++) {
- if (ONIGENC_CODE_TO_MBCLEN(enc, c) > 0 /* check invalid code point */
+ /* check invalid code point */
+ if ((is_single != 0 || ONIGENC_CODE_TO_MBCLEN(enc, c) == 1)
&& ! ONIGENC_IS_CODE_CTYPE(enc, (OnigCodePoint )c, ctype))
BITSET_SET_BIT(cc->bs, c);
}
for (c = limit; c < SINGLE_BYTE_SIZE; c++) {
- if (ONIGENC_CODE_TO_MBCLEN(enc, c) > 0)
+ if (is_single != 0 || ONIGENC_CODE_TO_MBCLEN(enc, c) == 1)
BITSET_SET_BIT(cc->bs, c);
}
+ if (ascii_mode != 0 && is_single == 0)
+ ADD_ALL_MULTI_BYTE_RANGE(enc, cc->mbuf);
}
else {
for (c = 0; c < (int )limit; c++) {
- if (ONIGENC_IS_CODE_CTYPE(enc, (OnigCodePoint )c, ctype))
+ if ((is_single != 0 || ONIGENC_CODE_TO_MBCLEN(enc, c) == 1)
+ && ONIGENC_IS_CODE_CTYPE(enc, (OnigCodePoint )c, ctype))
BITSET_SET_BIT(cc->bs, c);
}
- if (ascii_mode == 0)
+ if (ascii_mode == 0 && is_single == 0)
ADD_ALL_MULTI_BYTE_RANGE(enc, cc->mbuf);
}
break;

4
oniguruma.spec
View File

@ -13,6 +13,7 @@ Patch100: oniguruma-6.8.2-CVE-2019-13225-fix.patch
Patch101: oniguruma-6.8.2-CVE-2019-13224-fix.patch
Patch102: oniguruma-6.8.2-CVE-2019-16163-fix.patch
Patch103: oniguruma-6.8.2-CVE-2019-19012-fix.patch
Patch104: oniguruma-6.8.2-CVE-2019-19203-fix.patch
%description
Oniguruma is a regular expressions library.
@ -52,6 +53,7 @@ done
%patch101 -p1 -b .CVE-2019-13224
%patch102 -p1 -b .CVE-2019-16163
%patch103 -p1 -b .CVE-2019-19012
%patch104 -p1 -b .CVE-2019-19203
%build
%configure \
@ -115,6 +117,8 @@ find $RPM_BUILD_ROOT -name '*.la' \
Resolves: RHEL-9506
- Fix CVE-2019-19012
Resolves: RHEL-9511
- Fix CVE-2019-19203
Resolves: RHEL-9510
* Fri Jun 26 2020 Jiri Kucera <jkucera@redhat.com> - 6.8.2-2
- Fix CVE-2019-13225