From a7a9aa46aca32d8916e13e140b43644880801c1f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= Date: Fri, 16 Dec 2016 07:58:52 +0100 Subject: [PATCH] Fix a crash when doing an extended substitution for \p, \P, or \X --- ...-in-extended-substition-for-p-P-or-X.patch | 83 +++++++++++++++++++ pcre2.spec | 10 ++- 2 files changed, 92 insertions(+), 1 deletion(-) create mode 100644 pcre2-10.22-Fix-NULL-defer-in-extended-substition-for-p-P-or-X.patch diff --git a/pcre2-10.22-Fix-NULL-defer-in-extended-substition-for-p-P-or-X.patch b/pcre2-10.22-Fix-NULL-defer-in-extended-substition-for-p-P-or-X.patch new file mode 100644 index 0000000..05624aa --- /dev/null +++ b/pcre2-10.22-Fix-NULL-defer-in-extended-substition-for-p-P-or-X.patch @@ -0,0 +1,83 @@ +From d8fd0a6ed323e5abaaa7e8f26ed1f74ab3a54007 Mon Sep 17 00:00:00 2001 +From: ph10 +Date: Fri, 9 Dec 2016 16:57:51 +0000 +Subject: [PATCH] Fix NULL defer in extended substition for \p, \P, or \X. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Petr Pisar: Ported to 10.22: + +commit 83a8a8c6d01e4a39830704a4270821b390f20488 +Author: ph10 +Date: Fri Dec 9 16:57:51 2016 +0000 + + Fix NULL defer in extended substition for \p, \P, or \X. + + git-svn-id: svn://vcs.exim.org/pcre2/code/trunk@615 6239d852-aaf2-0410-a92c-79f79f948069 + +Signed-off-by: Petr Písař +--- + src/pcre2_compile.c | 10 +++++----- + testdata/testinput2 | 3 +++ + testdata/testoutput2 | 4 ++++ + 3 files changed, 12 insertions(+), 5 deletions(-) + +diff --git a/src/pcre2_compile.c b/src/pcre2_compile.c +index ed81639..ae6b5e1 100644 +--- a/src/pcre2_compile.c ++++ b/src/pcre2_compile.c +@@ -1793,10 +1793,10 @@ entry, ptr is pointing at the \. On exit, it points the final code unit of the + escape sequence. + + This function is also called from pcre2_substitute() to handle escape sequences +-in replacement strings. In this case, the cb argument is NULL, and only +-sequences that define a data character are recognised. The isclass argument is +-not relevant, but the options argument is the final value of the compiled +-pattern's options. ++in replacement strings. In this case, the cb argument is NULL, and in the case ++of escapes that have further processing, only sequences that define a data ++character are recognised. The isclass argument is not relevant; the options ++argument is the final value of the compiled pattern's options. + + There is one "trick" case: when a sequence such as [[:>:]] or \s in UCP mode is + processed, it is replaced by a nested alternative sequence. If this contains a +@@ -1858,7 +1858,7 @@ else if ((i = escapes[c - ESCAPES_FIRST]) != 0) + if (i > 0) c = (uint32_t)i; else /* Positive is a data character */ + { + escape = -i; /* Else return a special escape */ +- if (escape == ESC_P || escape == ESC_p || escape == ESC_X) ++ if (cb != NULL && (escape == ESC_P || escape == ESC_p || escape == ESC_X)) + cb->external_flags |= PCRE2_HASBKPORX; /* Note \P, \p, or \X */ + } + } +diff --git a/testdata/testinput2 b/testdata/testinput2 +index 3218cfe..a7c1ab3 100644 +--- a/testdata/testinput2 ++++ b/testdata/testinput2 +@@ -4828,4 +4828,7 @@ a)"xI + /./newline=crlf + \=ph + ++/(\x0e00\000000\xc)/replace=\P,substitute_extended ++\x0e00\000000\xc ++ + # End of testinput2 +diff --git a/testdata/testoutput2 b/testdata/testoutput2 +index 1776d0d..9c478bb 100644 +--- a/testdata/testoutput2 ++++ b/testdata/testoutput2 +@@ -15231,6 +15231,10 @@ Subject length lower bound = 0 + \=ph + No match + ++/(\x0e00\000000\xc)/replace=\P,substitute_extended ++\x0e00\000000\xc ++Failed: error -57 at offset 2 in replacement: bad escape sequence in replacement string ++ + # End of testinput2 + Error -63: PCRE2_ERROR_BADDATA (unknown error number) + Error -62: bad serialized data +-- +2.7.4 + diff --git a/pcre2.spec b/pcre2.spec index 2ade0a7..7b443f3 100644 --- a/pcre2.spec +++ b/pcre2.spec @@ -2,7 +2,7 @@ #%%global rcversion RC1 Name: pcre2 Version: 10.22 -Release: %{?rcversion:0.}7%{?rcversion:.%rcversion}%{?dist} +Release: %{?rcversion:0.}8%{?rcversion:.%rcversion}%{?dist} %global myversion %{version}%{?rcversion:-%rcversion} Summary: Perl-compatible regular expression library Group: System Environment/Libraries @@ -67,6 +67,9 @@ Patch14: pcre2-10.22-Fix-buffer-overflow-in-partial-match-test-for-CRLF-i.pat # Fix a crash in pcre2test when displaying a wide character with a set locate, # in upstream after 10.22, upstream bug #1976 Patch15: pcre2-10.22-Fix-crash-in-pcre2test-when-displaying-a-wide-charac.patch +# Fix a crash when doing an extended substitution for \p, \P, or \X, +# in upstream after 10.22, upstream bug #1977 +Patch16: pcre2-10.22-Fix-NULL-defer-in-extended-substition-for-p-P-or-X.patch # New libtool to get rid of RPATH and to use distribution autotools BuildRequires: autoconf BuildRequires: automake @@ -159,6 +162,7 @@ Utilities demonstrating PCRE2 capabilities like pcre2grep or pcre2test. %patch13 -p1 %patch14 -p1 %patch15 -p1 +%patch16 -p1 # Because of multilib patch libtoolize --copy --force autoreconf -vif @@ -255,6 +259,10 @@ make %{?_smp_mflags} check VERBOSE=yes %{_mandir}/man1/pcre2test.* %changelog +* Fri Dec 16 2016 Petr Pisar - 10.22-8 +- Fix a crash when doing an extended substitution for \p, \P, or \X + (upstream bug #1977) + * Fri Dec 09 2016 Petr Pisar - 10.22-7 - Fix pcre2-config --libs-posix output (upstream bug #1924) - Fix a memory leak and a typo in a documentation (upstream bug #1973)