Fix a buffer overflow with duplicated named groups and an occurrence of "(?|"
This commit is contained in:
Petr Písař
parent
5e196467b7
commit
7da5705443
110
pcre-8.37-Fix-another-buffer-overflow.patch
Normal file
110
pcre-8.37-Fix-another-buffer-overflow.patch
Normal file
@ -0,0 +1,110 @@
|
|||||||
|
From f6efcf125123199d446c5561266c3c3846ed9f30 Mon Sep 17 00:00:00 2001
|
||||||
|
From: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
|
||||||
|
Date: Wed, 3 Jun 2015 16:51:59 +0000
|
||||||
|
Subject: [PATCH] Fix another buffer overflow.
|
||||||
|
MIME-Version: 1.0
|
||||||
|
Content-Type: text/plain; charset=UTF-8
|
||||||
|
Content-Transfer-Encoding: 8bit
|
||||||
|
|
||||||
|
Ported to 8.37:
|
||||||
|
|
||||||
|
commit 225f0d5eb16c7a26591a1e3f286c7476907b5a6a
|
||||||
|
Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
|
||||||
|
Date: Wed Jun 3 16:51:59 2015 +0000
|
||||||
|
|
||||||
|
Fix another buffer overflow.
|
||||||
|
|
||||||
|
git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1562 2f5784b3-3f2a-0410-8824-cb99058d5e15
|
||||||
|
|
||||||
|
Signed-off-by: Petr Písař <ppisar@redhat.com>
|
||||||
|
---
|
||||||
|
pcre_compile.c | 7 ++++++-
|
||||||
|
testdata/testinput2 | 2 ++
|
||||||
|
testdata/testoutput11-16 | 2 +-
|
||||||
|
testdata/testoutput11-32 | 2 +-
|
||||||
|
testdata/testoutput11-8 | 2 +-
|
||||||
|
testdata/testoutput2 | 2 ++
|
||||||
|
6 files changed, 13 insertions(+), 4 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/pcre_compile.c b/pcre_compile.c
|
||||||
|
index 8b4aaef..f5d2384 100644
|
||||||
|
--- a/pcre_compile.c
|
||||||
|
+++ b/pcre_compile.c
|
||||||
|
@@ -7210,7 +7210,12 @@ for (;; ptr++)
|
||||||
|
real compile this will be picked up and the reference wrapped with
|
||||||
|
OP_ONCE to make it atomic, so we must space in case this occurs. */
|
||||||
|
|
||||||
|
- if (recno == 0) *lengthptr += 2 + 2*LINK_SIZE;
|
||||||
|
+ /* In fact, this can happen for a non-forward reference because
|
||||||
|
+ another group with the same number might be created later. This
|
||||||
|
+ issue is fixed "properly" in PCRE2. As PCRE1 is now in maintenance
|
||||||
|
+ only mode, we finesse the bug by allowing more memory always. */
|
||||||
|
+
|
||||||
|
+ /* if (recno == 0) */ *lengthptr += 2 + 2*LINK_SIZE;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* In the real compile, search the name table. We check the name
|
||||||
|
diff --git a/testdata/testinput2 b/testdata/testinput2
|
||||||
|
index 5cc9ce6..e12de3a 100644
|
||||||
|
--- a/testdata/testinput2
|
||||||
|
+++ b/testdata/testinput2
|
||||||
|
@@ -4156,4 +4156,6 @@ backtracking verbs. --/
|
||||||
|
|
||||||
|
/(?=di(?<=(?1))|(?=(.))))/
|
||||||
|
|
||||||
|
+"(?J:(?|(?'R')(\k'R')|((?'R'))))"
|
||||||
|
+
|
||||||
|
/-- End of testinput2 --/
|
||||||
|
diff --git a/testdata/testoutput11-16 b/testdata/testoutput11-16
|
||||||
|
index 422f2ad..e222e7c 100644
|
||||||
|
--- a/testdata/testoutput11-16
|
||||||
|
+++ b/testdata/testoutput11-16
|
||||||
|
@@ -231,7 +231,7 @@ Memory allocation (code space): 73
|
||||||
|
------------------------------------------------------------------
|
||||||
|
|
||||||
|
/(?P<a>a)...(?P=a)bbb(?P>a)d/BM
|
||||||
|
-Memory allocation (code space): 61
|
||||||
|
+Memory allocation (code space): 77
|
||||||
|
------------------------------------------------------------------
|
||||||
|
0 24 Bra
|
||||||
|
2 5 CBra 1
|
||||||
|
diff --git a/testdata/testoutput11-32 b/testdata/testoutput11-32
|
||||||
|
index d953ec8..9a80ec9 100644
|
||||||
|
--- a/testdata/testoutput11-32
|
||||||
|
+++ b/testdata/testoutput11-32
|
||||||
|
@@ -231,7 +231,7 @@ Memory allocation (code space): 155
|
||||||
|
------------------------------------------------------------------
|
||||||
|
|
||||||
|
/(?P<a>a)...(?P=a)bbb(?P>a)d/BM
|
||||||
|
-Memory allocation (code space): 125
|
||||||
|
+Memory allocation (code space): 157
|
||||||
|
------------------------------------------------------------------
|
||||||
|
0 24 Bra
|
||||||
|
2 5 CBra 1
|
||||||
|
diff --git a/testdata/testoutput11-8 b/testdata/testoutput11-8
|
||||||
|
index 6ec18ec..3adaca2 100644
|
||||||
|
--- a/testdata/testoutput11-8
|
||||||
|
+++ b/testdata/testoutput11-8
|
||||||
|
@@ -231,7 +231,7 @@ Memory allocation (code space): 45
|
||||||
|
------------------------------------------------------------------
|
||||||
|
|
||||||
|
/(?P<a>a)...(?P=a)bbb(?P>a)d/BM
|
||||||
|
-Memory allocation (code space): 38
|
||||||
|
+Memory allocation (code space): 50
|
||||||
|
------------------------------------------------------------------
|
||||||
|
0 30 Bra
|
||||||
|
3 7 CBra 1
|
||||||
|
diff --git a/testdata/testoutput2 b/testdata/testoutput2
|
||||||
|
index 4decb8d..5bad26c 100644
|
||||||
|
--- a/testdata/testoutput2
|
||||||
|
+++ b/testdata/testoutput2
|
||||||
|
@@ -14428,4 +14428,6 @@ Failed: lookbehind assertion is not fixed length at offset 17
|
||||||
|
/(?=di(?<=(?1))|(?=(.))))/
|
||||||
|
Failed: unmatched parentheses at offset 23
|
||||||
|
|
||||||
|
+"(?J:(?|(?'R')(\k'R')|((?'R'))))"
|
||||||
|
+
|
||||||
|
/-- End of testinput2 --/
|
||||||
|
--
|
||||||
|
2.4.3
|
||||||
|
|
||||||
@ -0,0 +1,190 @@
|
|||||||
|
From b3f0b0dd971314df8f865e221aa1a88e75d6d1a6 Mon Sep 17 00:00:00 2001
|
||||||
|
From: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
|
||||||
|
Date: Wed, 5 Aug 2015 15:38:32 +0000
|
||||||
|
Subject: [PATCH] Fix buffer overflow for named references in (?| situations.
|
||||||
|
MIME-Version: 1.0
|
||||||
|
Content-Type: text/plain; charset=UTF-8
|
||||||
|
Content-Transfer-Encoding: 8bit
|
||||||
|
|
||||||
|
Ported for 8.37:
|
||||||
|
|
||||||
|
commit 7af8e8717def179fd7b69e173abd347c1a3547cb
|
||||||
|
Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
|
||||||
|
Date: Wed Aug 5 15:38:32 2015 +0000
|
||||||
|
|
||||||
|
Fix buffer overflow for named references in (?| situations.
|
||||||
|
|
||||||
|
git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1585 2f5784b3-3f2a-0410-8824-cb99058d5e15
|
||||||
|
|
||||||
|
Signed-off-by: Petr Písař <ppisar@redhat.com>
|
||||||
|
---
|
||||||
|
pcre_compile.c | 74 ++++++++++++++++++++++++++++++----------------------
|
||||||
|
pcre_internal.h | 1 +
|
||||||
|
testdata/testinput2 | 2 ++
|
||||||
|
testdata/testoutput2 | 2 ++
|
||||||
|
4 files changed, 48 insertions(+), 31 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/pcre_compile.c b/pcre_compile.c
|
||||||
|
index f5d2384..5fe5c1d 100644
|
||||||
|
--- a/pcre_compile.c
|
||||||
|
+++ b/pcre_compile.c
|
||||||
|
@@ -6641,6 +6641,7 @@ for (;; ptr++)
|
||||||
|
/* ------------------------------------------------------------ */
|
||||||
|
case CHAR_VERTICAL_LINE: /* Reset capture count for each branch */
|
||||||
|
reset_bracount = TRUE;
|
||||||
|
+ cd->dupgroups = TRUE; /* Record (?| encountered */
|
||||||
|
/* Fall through */
|
||||||
|
|
||||||
|
/* ------------------------------------------------------------ */
|
||||||
|
@@ -7151,7 +7152,8 @@ for (;; ptr++)
|
||||||
|
if (lengthptr != NULL)
|
||||||
|
{
|
||||||
|
named_group *ng;
|
||||||
|
-
|
||||||
|
+ recno = 0;
|
||||||
|
+
|
||||||
|
if (namelen == 0)
|
||||||
|
{
|
||||||
|
*errorcodeptr = ERR62;
|
||||||
|
@@ -7168,32 +7170,6 @@ for (;; ptr++)
|
||||||
|
goto FAILED;
|
||||||
|
}
|
||||||
|
|
||||||
|
- /* The name table does not exist in the first pass; instead we must
|
||||||
|
- scan the list of names encountered so far in order to get the
|
||||||
|
- number. If the name is not found, set the value to 0 for a forward
|
||||||
|
- reference. */
|
||||||
|
-
|
||||||
|
- recno = 0;
|
||||||
|
- ng = cd->named_groups;
|
||||||
|
- for (i = 0; i < cd->names_found; i++, ng++)
|
||||||
|
- {
|
||||||
|
- if (namelen == ng->length &&
|
||||||
|
- STRNCMP_UC_UC(name, ng->name, namelen) == 0)
|
||||||
|
- {
|
||||||
|
- open_capitem *oc;
|
||||||
|
- recno = ng->number;
|
||||||
|
- if (is_recurse) break;
|
||||||
|
- for (oc = cd->open_caps; oc != NULL; oc = oc->next)
|
||||||
|
- {
|
||||||
|
- if (oc->number == recno)
|
||||||
|
- {
|
||||||
|
- oc->flag = TRUE;
|
||||||
|
- break;
|
||||||
|
- }
|
||||||
|
- }
|
||||||
|
- }
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
/* Count named back references. */
|
||||||
|
|
||||||
|
if (!is_recurse) cd->namedrefcount++;
|
||||||
|
@@ -7215,7 +7191,44 @@ for (;; ptr++)
|
||||||
|
issue is fixed "properly" in PCRE2. As PCRE1 is now in maintenance
|
||||||
|
only mode, we finesse the bug by allowing more memory always. */
|
||||||
|
|
||||||
|
- /* if (recno == 0) */ *lengthptr += 2 + 2*LINK_SIZE;
|
||||||
|
+ *lengthptr += 2 + 2*LINK_SIZE;
|
||||||
|
+
|
||||||
|
+ /* It is even worse than that. The current reference may be to an
|
||||||
|
+ existing named group with a different number (so apparently not
|
||||||
|
+ recursive) but which later on is also attached to a group with the
|
||||||
|
+ current number. This can only happen if $(| has been previous
|
||||||
|
+ encountered. In that case, we allow yet more memory, just in case.
|
||||||
|
+ (Again, this is fixed "properly" in PCRE2. */
|
||||||
|
+
|
||||||
|
+ if (cd->dupgroups) *lengthptr += 2 + 2*LINK_SIZE;
|
||||||
|
+
|
||||||
|
+ /* Otherwise, check for recursion here. The name table does not exist
|
||||||
|
+ in the first pass; instead we must scan the list of names encountered
|
||||||
|
+ so far in order to get the number. If the name is not found, leave
|
||||||
|
+ the value of recno as 0 for a forward reference. */
|
||||||
|
+
|
||||||
|
+ else
|
||||||
|
+ {
|
||||||
|
+ ng = cd->named_groups;
|
||||||
|
+ for (i = 0; i < cd->names_found; i++, ng++)
|
||||||
|
+ {
|
||||||
|
+ if (namelen == ng->length &&
|
||||||
|
+ STRNCMP_UC_UC(name, ng->name, namelen) == 0)
|
||||||
|
+ {
|
||||||
|
+ open_capitem *oc;
|
||||||
|
+ recno = ng->number;
|
||||||
|
+ if (is_recurse) break;
|
||||||
|
+ for (oc = cd->open_caps; oc != NULL; oc = oc->next)
|
||||||
|
+ {
|
||||||
|
+ if (oc->number == recno)
|
||||||
|
+ {
|
||||||
|
+ oc->flag = TRUE;
|
||||||
|
+ break;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
|
||||||
|
/* In the real compile, search the name table. We check the name
|
||||||
|
@@ -7262,8 +7275,6 @@ for (;; ptr++)
|
||||||
|
for (i++; i < cd->names_found; i++)
|
||||||
|
{
|
||||||
|
if (STRCMP_UC_UC(slot + IMM2_SIZE, cslot + IMM2_SIZE) != 0) break;
|
||||||
|
-
|
||||||
|
-
|
||||||
|
count++;
|
||||||
|
cslot += cd->name_entry_size;
|
||||||
|
}
|
||||||
|
@@ -9189,6 +9200,7 @@ cd->names_found = 0;
|
||||||
|
cd->name_entry_size = 0;
|
||||||
|
cd->name_table = NULL;
|
||||||
|
cd->dupnames = FALSE;
|
||||||
|
+cd->dupgroups = FALSE;
|
||||||
|
cd->namedrefcount = 0;
|
||||||
|
cd->start_code = cworkspace;
|
||||||
|
cd->hwm = cworkspace;
|
||||||
|
@@ -9223,7 +9235,7 @@ if (errorcode != 0) goto PCRE_EARLY_ERROR_RETURN;
|
||||||
|
|
||||||
|
DPRINTF(("end pre-compile: length=%d workspace=%d\n", length,
|
||||||
|
(int)(cd->hwm - cworkspace)));
|
||||||
|
-
|
||||||
|
+
|
||||||
|
if (length > MAX_PATTERN_SIZE)
|
||||||
|
{
|
||||||
|
errorcode = ERR20;
|
||||||
|
diff --git a/pcre_internal.h b/pcre_internal.h
|
||||||
|
index dd0ac7f..7ca6020 100644
|
||||||
|
--- a/pcre_internal.h
|
||||||
|
+++ b/pcre_internal.h
|
||||||
|
@@ -2446,6 +2446,7 @@ typedef struct compile_data {
|
||||||
|
BOOL had_pruneorskip; /* (*PRUNE) or (*SKIP) encountered */
|
||||||
|
BOOL check_lookbehind; /* Lookbehinds need later checking */
|
||||||
|
BOOL dupnames; /* Duplicate names exist */
|
||||||
|
+ BOOL dupgroups; /* Duplicate groups exist: (?| found */
|
||||||
|
BOOL iscondassert; /* Next assert is a condition */
|
||||||
|
int nltype; /* Newline type */
|
||||||
|
int nllen; /* Newline string length */
|
||||||
|
diff --git a/testdata/testinput2 b/testdata/testinput2
|
||||||
|
index e12de3a..8e044f8 100644
|
||||||
|
--- a/testdata/testinput2
|
||||||
|
+++ b/testdata/testinput2
|
||||||
|
@@ -4158,4 +4158,6 @@ backtracking verbs. --/
|
||||||
|
|
||||||
|
"(?J:(?|(?'R')(\k'R')|((?'R'))))"
|
||||||
|
|
||||||
|
+/(?J:(?|(:(?|(?'R')(\k'R')|((?'R')))H'Rk'Rf)|s(?'R')))/
|
||||||
|
+
|
||||||
|
/-- End of testinput2 --/
|
||||||
|
diff --git a/testdata/testoutput2 b/testdata/testoutput2
|
||||||
|
index 5bad26c..6019425 100644
|
||||||
|
--- a/testdata/testoutput2
|
||||||
|
+++ b/testdata/testoutput2
|
||||||
|
@@ -14430,4 +14430,6 @@ Failed: unmatched parentheses at offset 23
|
||||||
|
|
||||||
|
"(?J:(?|(?'R')(\k'R')|((?'R'))))"
|
||||||
|
|
||||||
|
+/(?J:(?|(:(?|(?'R')(\k'R')|((?'R')))H'Rk'Rf)|s(?'R')))/
|
||||||
|
+
|
||||||
|
/-- End of testinput2 --/
|
||||||
|
--
|
||||||
|
2.4.3
|
||||||
|
|
||||||
@ -0,0 +1,98 @@
|
|||||||
|
From 83ed574998fe7b844b98ab7cd56291068feb9e31 Mon Sep 17 00:00:00 2001
|
||||||
|
From: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
|
||||||
|
Date: Sat, 16 May 2015 11:05:40 +0000
|
||||||
|
Subject: [PATCH] Fix named forward reference to duplicate group number
|
||||||
|
overflow bug.
|
||||||
|
MIME-Version: 1.0
|
||||||
|
Content-Type: text/plain; charset=UTF-8
|
||||||
|
Content-Transfer-Encoding: 8bit
|
||||||
|
|
||||||
|
Port to 8.37:
|
||||||
|
|
||||||
|
commit 2fa78aa4e42bcebf2d616c4ee89c012f29dc3447
|
||||||
|
Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
|
||||||
|
Date: Sat May 16 11:05:40 2015 +0000
|
||||||
|
|
||||||
|
Fix named forward reference to duplicate group number overflow bug.
|
||||||
|
|
||||||
|
git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1559 2f5784b3-3f2a-0410-8824-cb99058d5e15
|
||||||
|
|
||||||
|
Signed-off-by: Petr Písař <ppisar@redhat.com>
|
||||||
|
---
|
||||||
|
pcre_compile.c | 24 ++++++++++++++++--------
|
||||||
|
testdata/testinput1 | 3 +++
|
||||||
|
testdata/testoutput1 | 5 +++++
|
||||||
|
3 files changed, 24 insertions(+), 8 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/pcre_compile.c b/pcre_compile.c
|
||||||
|
index b66b1f6..8b4aaef 100644
|
||||||
|
--- a/pcre_compile.c
|
||||||
|
+++ b/pcre_compile.c
|
||||||
|
@@ -7183,15 +7183,15 @@ for (;; ptr++)
|
||||||
|
open_capitem *oc;
|
||||||
|
recno = ng->number;
|
||||||
|
if (is_recurse) break;
|
||||||
|
- for (oc = cd->open_caps; oc != NULL; oc = oc->next)
|
||||||
|
- {
|
||||||
|
- if (oc->number == recno)
|
||||||
|
- {
|
||||||
|
- oc->flag = TRUE;
|
||||||
|
+ for (oc = cd->open_caps; oc != NULL; oc = oc->next)
|
||||||
|
+ {
|
||||||
|
+ if (oc->number == recno)
|
||||||
|
+ {
|
||||||
|
+ oc->flag = TRUE;
|
||||||
|
break;
|
||||||
|
- }
|
||||||
|
- }
|
||||||
|
- }
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Count named back references. */
|
||||||
|
@@ -7203,6 +7203,14 @@ for (;; ptr++)
|
||||||
|
16-bit data item. */
|
||||||
|
|
||||||
|
*lengthptr += IMM2_SIZE;
|
||||||
|
+
|
||||||
|
+ /* If this is a forward reference and we are within a (?|...) group,
|
||||||
|
+ the reference may end up as the number of a group which we are
|
||||||
|
+ currently inside, that is, it could be a recursive reference. In the
|
||||||
|
+ real compile this will be picked up and the reference wrapped with
|
||||||
|
+ OP_ONCE to make it atomic, so we must space in case this occurs. */
|
||||||
|
+
|
||||||
|
+ if (recno == 0) *lengthptr += 2 + 2*LINK_SIZE;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* In the real compile, search the name table. We check the name
|
||||||
|
diff --git a/testdata/testinput1 b/testdata/testinput1
|
||||||
|
index 73c2f4d..8379ce0 100644
|
||||||
|
--- a/testdata/testinput1
|
||||||
|
+++ b/testdata/testinput1
|
||||||
|
@@ -5730,4 +5730,7 @@ AbcdCBefgBhiBqz
|
||||||
|
"(?1)(?#?'){8}(a)"
|
||||||
|
baaaaaaaaac
|
||||||
|
|
||||||
|
+"(?|(\k'Pm')|(?'Pm'))"
|
||||||
|
+ abcd
|
||||||
|
+
|
||||||
|
/-- End of testinput1 --/
|
||||||
|
diff --git a/testdata/testoutput1 b/testdata/testoutput1
|
||||||
|
index 0a53fd0..e852ab9 100644
|
||||||
|
--- a/testdata/testoutput1
|
||||||
|
+++ b/testdata/testoutput1
|
||||||
|
@@ -9429,4 +9429,9 @@ No match
|
||||||
|
0: aaaaaaaaa
|
||||||
|
1: a
|
||||||
|
|
||||||
|
+"(?|(\k'Pm')|(?'Pm'))"
|
||||||
|
+ abcd
|
||||||
|
+ 0:
|
||||||
|
+ 1:
|
||||||
|
+
|
||||||
|
/-- End of testinput1 --/
|
||||||
|
--
|
||||||
|
2.4.3
|
||||||
|
|
||||||
21
pcre.spec
21
pcre.spec
@ -2,7 +2,7 @@
|
|||||||
#%%global rcversion RC1
|
#%%global rcversion RC1
|
||||||
Name: pcre
|
Name: pcre
|
||||||
Version: 8.37
|
Version: 8.37
|
||||||
Release: %{?rcversion:0.}2%{?rcversion:.%rcversion}%{?dist}
|
Release: %{?rcversion:0.}3%{?rcversion:.%rcversion}%{?dist}
|
||||||
%global myversion %{version}%{?rcversion:-%rcversion}
|
%global myversion %{version}%{?rcversion:-%rcversion}
|
||||||
Summary: Perl-compatible regular expression library
|
Summary: Perl-compatible regular expression library
|
||||||
Group: System Environment/Libraries
|
Group: System Environment/Libraries
|
||||||
@ -35,6 +35,15 @@ Patch1: pcre-8.32-refused_spelling_terminated.patch
|
|||||||
Patch2: pcre-8.37-Fix-buffer-overflow-for-named-recursive-back-referen.patch
|
Patch2: pcre-8.37-Fix-buffer-overflow-for-named-recursive-back-referen.patch
|
||||||
# Fix CVE-2015-5073, bug #1237224
|
# Fix CVE-2015-5073, bug #1237224
|
||||||
Patch3: pcre-8.37-Fix-buffer-overflow-for-forward-reference-within-bac.patch
|
Patch3: pcre-8.37-Fix-buffer-overflow-for-forward-reference-within-bac.patch
|
||||||
|
# Needed for Fix-buffer-overflow-for-named-references-in-situatio.patch,
|
||||||
|
# in upstream after 8.37
|
||||||
|
Patch4: pcre-8.37-Fix-named-forward-reference-to-duplicate-group-numbe.patch
|
||||||
|
# Needed for Fix-buffer-overflow-for-named-references-in-situatio.patch,
|
||||||
|
# in upstream after 8.37
|
||||||
|
Patch5: pcre-8.37-Fix-another-buffer-overflow.patch
|
||||||
|
# Fix a buffer overflow with duplicated named groups and an occurrence of "(?|",
|
||||||
|
# <https://bugs.exim.org/show_bug.cgi?id=1667>, in upstream after 8.37
|
||||||
|
Patch6: pcre-8.37-Fix-buffer-overflow-for-named-references-in-situatio.patch
|
||||||
BuildRequires: readline-devel
|
BuildRequires: readline-devel
|
||||||
# New libtool to get rid of rpath
|
# New libtool to get rid of rpath
|
||||||
BuildRequires: autoconf, automake, libtool
|
BuildRequires: autoconf, automake, libtool
|
||||||
@ -78,6 +87,9 @@ Utilities demonstrating PCRE capabilities like pcregrep or pcretest.
|
|||||||
%patch1 -p1 -b .terminated_typos
|
%patch1 -p1 -b .terminated_typos
|
||||||
%patch2 -p1 -b .CVE-2015-3210
|
%patch2 -p1 -b .CVE-2015-3210
|
||||||
%patch3 -p1 -b .CVE-2015-5073
|
%patch3 -p1 -b .CVE-2015-5073
|
||||||
|
%patch4 -p1
|
||||||
|
%patch5 -p1
|
||||||
|
%patch6 -p1
|
||||||
# Because of rpath patch
|
# Because of rpath patch
|
||||||
libtoolize --copy --force && autoreconf -vif
|
libtoolize --copy --force && autoreconf -vif
|
||||||
# One contributor's name is non-UTF-8
|
# One contributor's name is non-UTF-8
|
||||||
@ -148,6 +160,13 @@ make %{?_smp_mflags} check VERBOSE=yes
|
|||||||
%{_mandir}/man1/pcretest.*
|
%{_mandir}/man1/pcretest.*
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Thu Aug 06 2015 Petr Pisar <ppisar@redhat.com> - 8.37-3
|
||||||
|
- Fix a buffer overflow with duplicated named groups with a reference between
|
||||||
|
their definition, with a group that reset capture numbers
|
||||||
|
- Fix a buffer overflow with a forward reference by name to a group whose
|
||||||
|
number is the same as the current group
|
||||||
|
- Fix a buffer overflow with duplicated named groups and an occurrence of "(?|"
|
||||||
|
|
||||||
* Wed Jul 01 2015 Petr Pisar <ppisar@redhat.com> - 8.37-2
|
* Wed Jul 01 2015 Petr Pisar <ppisar@redhat.com> - 8.37-2
|
||||||
- Fix CVE-2015-3210 (heap overflow when compiling an expression with named
|
- Fix CVE-2015-3210 (heap overflow when compiling an expression with named
|
||||||
recursive back reference and the name is duplicated) (bug #1236659)
|
recursive back reference and the name is duplicated) (bug #1236659)
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user