rpms/pcre2
6
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix a crash in substitution if starting offest was specified beyond the subject end

Browse Source
This commit is contained in:
Petr Písař 2016-12-16 08:15:31 +01:00
parent a7a9aa46ac
commit 7b0bc0d59d
2 changed files with 79 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

73
pcre2-10.22-Fix-OOB-error-in-substitute-with-start-offset-longer.patch Normal file
View File

@ -0,0 +1,73 @@
From 3f4e0af094ac3d6facb7b8e581ba4bdf47d7d45d Mon Sep 17 00:00:00 2001
From: ph10 <ph10@6239d852-aaf2-0410-a92c-79f79f948069>
Date: Fri, 9 Dec 2016 18:19:38 +0000
Subject: [PATCH] Fix OOB error in substitute with start offset longer than
length.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Petr Pisar: Port to 10.22:
commit a27071aeed86de6febe845edb6c7376faa2176ba
Author: ph10 <ph10@6239d852-aaf2-0410-a92c-79f79f948069>
Date: Fri Dec 9 18:19:38 2016 +0000
Fix OOB error in substitute with start offset longer than length.
git-svn-id: svn://vcs.exim.org/pcre2/code/trunk@616 6239d852-aaf2-0410-a92c-79f79f948069
Signed-off-by: Petr Písař <ppisar@redhat.com>
---
src/pcre2_substitute.c | 6 ++++++
testdata/testinput2 | 3 +++
testdata/testoutput2 | 4 ++++
3 files changed, 13 insertions(+)
diff --git a/src/pcre2_substitute.c b/src/pcre2_substitute.c
index 0bf781e..2467d16 100644
--- a/src/pcre2_substitute.c
+++ b/src/pcre2_substitute.c
@@ -287,6 +287,12 @@ options &= ~SUBSTITUTE_OPTIONS;
/* Copy up to the start offset */
+if (start_offset > length)
+ {
+ match_data->leftchar = 0;
+ rc = PCRE2_ERROR_BADOFFSET;
+ goto EXIT;
+ }
CHECKMEMCPY(subject, start_offset);
/* Loop for global substituting. */
diff --git a/testdata/testinput2 b/testdata/testinput2
index a7c1ab3..e2865b2 100644
--- a/testdata/testinput2
+++ b/testdata/testinput2
@@ -4831,4 +4831,7 @@ a)"xI
/(\x0e00\000000\xc)/replace=\P,substitute_extended
\x0e00\000000\xc
+//replace=0
+\=offset=7
+
# End of testinput2
diff --git a/testdata/testoutput2 b/testdata/testoutput2
index 9c478bb..29de949 100644
--- a/testdata/testoutput2
+++ b/testdata/testoutput2
@@ -15235,6 +15235,10 @@ No match
\x0e00\000000\xc
Failed: error -57 at offset 2 in replacement: bad escape sequence in replacement string
+//replace=0
+\=offset=7
+Failed: error -33: bad offset value
+
# End of testinput2
Error -63: PCRE2_ERROR_BADDATA (unknown error number)
Error -62: bad serialized data
--
2.7.4

6
pcre2.spec
View File

@ -70,6 +70,9 @@ Patch15: pcre2-10.22-Fix-crash-in-pcre2test-when-displaying-a-wide-charac.pat
# Fix a crash when doing an extended substitution for \p, \P, or \X,
# in upstream after 10.22, upstream bug #1977
Patch16: pcre2-10.22-Fix-NULL-defer-in-extended-substition-for-p-P-or-X.patch
# Fix a crash in substitution if starting offest was specified beyond the
# subject end, in upstream after 10.22, upstream bug #1992
Patch17: pcre2-10.22-Fix-OOB-error-in-substitute-with-start-offset-longer.patch
# New libtool to get rid of RPATH and to use distribution autotools
BuildRequires: autoconf
BuildRequires: automake
@ -163,6 +166,7 @@ Utilities demonstrating PCRE2 capabilities like pcre2grep or pcre2test.
%patch14 -p1
%patch15 -p1
%patch16 -p1
%patch17 -p1
# Because of multilib patch
libtoolize --copy --force
autoreconf -vif
@ -262,6 +266,8 @@ make %{?_smp_mflags} check VERBOSE=yes
* Fri Dec 16 2016 Petr Pisar <ppisar@redhat.com> - 10.22-8
- Fix a crash when doing an extended substitution for \p, \P, or \X
(upstream bug #1977)
- Fix a crash in substitution if starting offest was specified beyond the
subject end (upstream bug #1992)
* Fri Dec 09 2016 Petr Pisar <ppisar@redhat.com> - 10.22-7
- Fix pcre2-config --libs-posix output (upstream bug #1924)