Fix CVE-2019-19012
Resolves: RHEL-9511
This commit is contained in:
Vitezslav Crhonek
parent
e95feeef8b
commit
9dacef57ff
204
oniguruma-6.8.2-CVE-2019-19012-fix.patch
Normal file
204
oniguruma-6.8.2-CVE-2019-19012-fix.patch
Normal file
@ -0,0 +1,204 @@
|
||||
diff -up onig-6.8.2/src/regexec.c.orig onig-6.8.2/src/regexec.c
|
||||
--- onig-6.8.2/src/regexec.c.orig 2018-04-17 02:08:37.000000000 +0200
|
||||
+++ onig-6.8.2/src/regexec.c 2023-12-07 15:39:01.502781873 +0100
|
||||
@@ -4384,14 +4384,14 @@ forward_search_range(regex_t* reg, const
|
||||
#endif
|
||||
|
||||
p = s;
|
||||
- if (reg->dmin > 0) {
|
||||
+ if (reg->dmin != 0) {
|
||||
+ if (end - p <= reg->dmin)
|
||||
+ return 0; /* fail */
|
||||
if (ONIGENC_IS_SINGLEBYTE(reg->enc)) {
|
||||
p += reg->dmin;
|
||||
}
|
||||
else {
|
||||
UChar *q = p + reg->dmin;
|
||||
-
|
||||
- if (q >= end) return 0; /* fail */
|
||||
while (p < q) p += enclen(reg->enc, p);
|
||||
}
|
||||
}
|
||||
@@ -4420,7 +4420,7 @@ forward_search_range(regex_t* reg, const
|
||||
}
|
||||
|
||||
if (p && p < range) {
|
||||
- if (p - reg->dmin < s) {
|
||||
+ if (p - s < reg->dmin) {
|
||||
retry_gate:
|
||||
pprev = p;
|
||||
p += enclen(reg->enc, p);
|
||||
@@ -4468,6 +4468,7 @@ forward_search_range(regex_t* reg, const
|
||||
*low_prev = onigenc_get_prev_char_head(reg->enc,
|
||||
(pprev ? pprev : str), p);
|
||||
}
|
||||
+ *high = p;
|
||||
}
|
||||
else {
|
||||
if (reg->dmax != INFINITE_LEN) {
|
||||
@@ -4492,9 +4493,12 @@ forward_search_range(regex_t* reg, const
|
||||
}
|
||||
}
|
||||
}
|
||||
+ /* no needs to adjust *high, *high is used as range check only */
|
||||
+ if (p - str < reg->dmin)
|
||||
+ *high = (UChar* )str;
|
||||
+ else
|
||||
+ *high = p - reg->dmin;
|
||||
}
|
||||
- /* no needs to adjust *high, *high is used as range check only */
|
||||
- *high = p - reg->dmin;
|
||||
|
||||
#ifdef ONIG_DEBUG_SEARCH
|
||||
fprintf(stderr,
|
||||
@@ -4517,7 +4521,6 @@ backward_search_range(regex_t* reg, cons
|
||||
{
|
||||
UChar *p;
|
||||
|
||||
- range += reg->dmin;
|
||||
p = s;
|
||||
|
||||
retry:
|
||||
@@ -4598,10 +4601,22 @@ backward_search_range(regex_t* reg, cons
|
||||
}
|
||||
}
|
||||
|
||||
- /* no needs to adjust *high, *high is used as range check only */
|
||||
if (reg->dmax != INFINITE_LEN) {
|
||||
- *low = p - reg->dmax;
|
||||
- *high = p - reg->dmin;
|
||||
+ if (p - str < reg->dmax)
|
||||
+ *low = (UChar* )str;
|
||||
+ else
|
||||
+ *low = p - reg->dmax;
|
||||
+
|
||||
+ if (reg->dmin != 0) {
|
||||
+ if (p - str < reg->dmin)
|
||||
+ *high = (UChar* )str;
|
||||
+ else
|
||||
+ *high = p - reg->dmin;
|
||||
+ }
|
||||
+ else {
|
||||
+ *high = p;
|
||||
+ }
|
||||
+
|
||||
*high = onigenc_get_right_adjust_char_head(reg->enc, adjrange, *high);
|
||||
}
|
||||
|
||||
@@ -4731,13 +4746,16 @@ onig_search_with_param(regex_t* reg, con
|
||||
goto mismatch_no_msa;
|
||||
|
||||
if (range > start) {
|
||||
- if ((OnigLen )(min_semi_end - start) > reg->anchor_dmax) {
|
||||
+ if (min_semi_end - start > reg->anchor_dmax) {
|
||||
start = min_semi_end - reg->anchor_dmax;
|
||||
if (start < end)
|
||||
start = onigenc_get_right_adjust_char_head(reg->enc, str, start);
|
||||
}
|
||||
- if ((OnigLen )(max_semi_end - (range - 1)) < reg->anchor_dmin) {
|
||||
- range = max_semi_end - reg->anchor_dmin + 1;
|
||||
+ if (max_semi_end - (range - 1) < reg->anchor_dmin) {
|
||||
+ if (max_semi_end - str + 1 < reg->anchor_dmin)
|
||||
+ goto mismatch_no_msa;
|
||||
+ else
|
||||
+ range = max_semi_end - reg->anchor_dmin + 1;
|
||||
}
|
||||
|
||||
if (start > range) goto mismatch_no_msa;
|
||||
@@ -4745,12 +4763,16 @@ onig_search_with_param(regex_t* reg, con
|
||||
Backward search is used. */
|
||||
}
|
||||
else {
|
||||
- if ((OnigLen )(min_semi_end - range) > reg->anchor_dmax) {
|
||||
+ if (min_semi_end - range > reg->anchor_dmax) {
|
||||
range = min_semi_end - reg->anchor_dmax;
|
||||
}
|
||||
- if ((OnigLen )(max_semi_end - start) < reg->anchor_dmin) {
|
||||
- start = max_semi_end - reg->anchor_dmin;
|
||||
- start = ONIGENC_LEFT_ADJUST_CHAR_HEAD(reg->enc, str, start);
|
||||
+ if (max_semi_end - start < reg->anchor_dmin) {
|
||||
+ if (max_semi_end - str < reg->anchor_dmin)
|
||||
+ goto mismatch_no_msa;
|
||||
+ else {
|
||||
+ start = max_semi_end - reg->anchor_dmin;
|
||||
+ start = ONIGENC_LEFT_ADJUST_CHAR_HEAD(reg->enc, str, start);
|
||||
+ }
|
||||
}
|
||||
if (range > start) goto mismatch_no_msa;
|
||||
}
|
||||
@@ -4818,15 +4840,19 @@ onig_search_with_param(regex_t* reg, con
|
||||
if (reg->optimize != OPTIMIZE_NONE) {
|
||||
UChar *sch_range, *low, *high, *low_prev;
|
||||
|
||||
- sch_range = (UChar* )range;
|
||||
if (reg->dmax != 0) {
|
||||
if (reg->dmax == INFINITE_LEN)
|
||||
sch_range = (UChar* )end;
|
||||
else {
|
||||
- sch_range += reg->dmax;
|
||||
- if (sch_range > end) sch_range = (UChar* )end;
|
||||
+ if ((end - range) < reg->dmax)
|
||||
+ sch_range = (UChar* )end;
|
||||
+ else {
|
||||
+ sch_range = (UChar* )range + reg->dmax;
|
||||
+ }
|
||||
}
|
||||
}
|
||||
+ else
|
||||
+ sch_range = (UChar* )range;
|
||||
|
||||
if ((end - start) < reg->threshold_len)
|
||||
goto mismatch;
|
||||
@@ -4885,18 +4911,28 @@ onig_search_with_param(regex_t* reg, con
|
||||
|
||||
if (reg->optimize != OPTIMIZE_NONE) {
|
||||
UChar *low, *high, *adjrange, *sch_start;
|
||||
+ const UChar *min_range;
|
||||
|
||||
if (range < end)
|
||||
adjrange = ONIGENC_LEFT_ADJUST_CHAR_HEAD(reg->enc, str, range);
|
||||
else
|
||||
adjrange = (UChar* )end;
|
||||
|
||||
+ if (end - range > reg->dmin)
|
||||
+ min_range = range + reg->dmin;
|
||||
+ else
|
||||
+ min_range = end;
|
||||
+
|
||||
if (reg->dmax != INFINITE_LEN &&
|
||||
(end - range) >= reg->threshold_len) {
|
||||
do {
|
||||
- sch_start = s + reg->dmax;
|
||||
- if (sch_start > end) sch_start = (UChar* )end;
|
||||
- if (backward_search_range(reg, str, end, sch_start, range, adjrange,
|
||||
+ if (end - s > reg->dmax)
|
||||
+ sch_start = s + reg->dmax;
|
||||
+ else {
|
||||
+ sch_start = (UChar* )end;
|
||||
+ }
|
||||
+
|
||||
+ if (backward_search_range(reg, str, end, sch_start, min_range, adjrange,
|
||||
&low, &high) <= 0)
|
||||
goto mismatch;
|
||||
|
||||
@@ -4914,19 +4950,7 @@ onig_search_with_param(regex_t* reg, con
|
||||
else { /* check only. */
|
||||
if ((end - range) < reg->threshold_len) goto mismatch;
|
||||
|
||||
- sch_start = s;
|
||||
- if (reg->dmax != 0) {
|
||||
- if (reg->dmax == INFINITE_LEN)
|
||||
- sch_start = (UChar* )end;
|
||||
- else {
|
||||
- sch_start += reg->dmax;
|
||||
- if (sch_start > end) sch_start = (UChar* )end;
|
||||
- else
|
||||
- sch_start = ONIGENC_LEFT_ADJUST_CHAR_HEAD(reg->enc,
|
||||
- start, sch_start);
|
||||
- }
|
||||
- }
|
||||
- if (backward_search_range(reg, str, end, sch_start, range, adjrange,
|
||||
+ if (backward_search_range(reg, str, end, sch_start, min_range, adjrange,
|
||||
&low, &high) <= 0) goto mismatch;
|
||||
}
|
||||
}
|
||||
@ -12,6 +12,7 @@ Source0: https://github.com/kkos/oniguruma/releases/download/v%{version}/onig-%{
|
||||
Patch100: oniguruma-6.8.2-CVE-2019-13225-fix.patch
|
||||
Patch101: oniguruma-6.8.2-CVE-2019-13224-fix.patch
|
||||
Patch102: oniguruma-6.8.2-CVE-2019-16163-fix.patch
|
||||
Patch103: oniguruma-6.8.2-CVE-2019-19012-fix.patch
|
||||
|
||||
%description
|
||||
Oniguruma is a regular expressions library.
|
||||
@ -50,6 +51,7 @@ done
|
||||
%patch100 -p1 -b .CVE-2019-13225
|
||||
%patch101 -p1 -b .CVE-2019-13224
|
||||
%patch102 -p1 -b .CVE-2019-16163
|
||||
%patch103 -p1 -b .CVE-2019-19012
|
||||
|
||||
%build
|
||||
%configure \
|
||||
@ -111,6 +113,8 @@ find $RPM_BUILD_ROOT -name '*.la' \
|
||||
Resolves: RHEL-6970
|
||||
- Fix CVE-2019-16163
|
||||
Resolves: RHEL-9506
|
||||
- Fix CVE-2019-19012
|
||||
Resolves: RHEL-9511
|
||||
|
||||
* Fri Jun 26 2020 Jiri Kucera <jkucera@redhat.com> - 6.8.2-2
|
||||
- Fix CVE-2019-13225
|
||||
|
||||
Loading…
Reference in New Issue
Block a user