diff --git a/pcre-8.40-Make-pcretest-check-size-of-O-argument.patch b/pcre-8.40-Make-pcretest-check-size-of-O-argument.patch new file mode 100644 index 0000000..cf59d7b --- /dev/null +++ b/pcre-8.40-Make-pcretest-check-size-of-O-argument.patch @@ -0,0 +1,37 @@ +From 312dd5d85714f73c247131b541405cf0bf24581b Mon Sep 17 00:00:00 2001 +From: ph10 +Date: Thu, 23 Feb 2017 16:24:08 +0000 +Subject: [PATCH] Make pcretest check size of \O argument. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1686 2f5784b3-3f2a-0410-8824-cb99058d5e15 + +Petr Písař: Ported to 8.40. + +diff --git a/pcretest.c b/pcretest.c +index 797f99c..0a153be 100644 +--- a/pcretest.c ++++ b/pcretest.c +@@ -4834,7 +4834,16 @@ while (!done) + continue; + + case 'O': +- while(isdigit(*p)) n = n * 10 + *p++ - '0'; ++ while(isdigit(*p)) ++ { ++ if (n > (INT_MAX-10)/10) /* Hack to stop fuzzers */ ++ { ++ printf("** \\O argument is too big\n"); ++ yield = 1; ++ goto EXIT; ++ } ++ n = n * 10 + *p++ - '0'; ++ } + if (n > size_offsets_max) + { + size_offsets_max = n; +-- +2.7.4 + diff --git a/pcre.spec b/pcre.spec index 30f482a..1e4016d 100644 --- a/pcre.spec +++ b/pcre.spec @@ -2,7 +2,7 @@ #%%global rcversion RC1 Name: pcre Version: 8.40 -Release: %{?rcversion:0.}4%{?rcversion:.%rcversion}%{?dist} +Release: %{?rcversion:0.}5%{?rcversion:.%rcversion}%{?dist} %global myversion %{version}%{?rcversion:-%rcversion} Summary: Perl-compatible regular expression library Group: System Environment/Libraries @@ -49,6 +49,9 @@ Patch5: pcre-8.40-Fix-recognition-of-style-comment-between-quantifier-.patch # Fix a crash in pcretest when printing non-ASCII characters, # upstream bug #2043, in upstream after 8.40 Patch6: pcre-8.40-Check-character-256-for-isprint-in-pcretest.patch +# Fix a crash in pcretest when \O directive was supplied with too big number, +# upstream bug #2044, in upstream after 8.40 +Patch7: pcre-8.40-Make-pcretest-check-size-of-O-argument.patch BuildRequires: readline-devel BuildRequires: autoconf BuildRequires: automake @@ -143,6 +146,7 @@ Utilities demonstrating PCRE capabilities like pcregrep or pcretest. %patch4 -p1 %patch5 -p1 %patch6 -p1 +%patch7 -p1 # Because of rpath patch libtoolize --copy --force autoreconf -vif @@ -239,6 +243,10 @@ make %{?_smp_mflags} check VERBOSE=yes %{_mandir}/man1/pcretest.* %changelog +* Fri Feb 24 2017 Petr Pisar - 8.40-5 +- Fix a crash in pcretest when \O directive was supplied with too big number + (upstream bug #2044) + * Thu Feb 23 2017 Petr Pisar - 8.40-4 - Fix a crash in pcretest when printing non-ASCII characters (upstream bug #2043)