118 lines
4.1 KiB
Diff
118 lines
4.1 KiB
Diff
From b251f0bc17a4d5a3b3f7690432113c773bcbe13f Mon Sep 17 00:00:00 2001
|
|
From: ph10 <ph10@6239d852-aaf2-0410-a92c-79f79f948069>
|
|
Date: Mon, 27 Jan 2020 10:28:19 +0000
|
|
Subject: [PATCH] Limit function recursion in pcre2_study to avoid stack
|
|
overflow issues.
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
git-svn-id: svn://vcs.exim.org/pcre2/code/trunk@1213 6239d852-aaf2-0410-a92c-79f79f948069
|
|
Petr Písař: Port to 10.34.
|
|
---
|
|
src/pcre2_study.c | 31 ++++++++++++++++++++++---------
|
|
|
|
diff --git a/src/pcre2_study.c b/src/pcre2_study.c
|
|
index 2883868..5af01b5 100644
|
|
--- a/src/pcre2_study.c
|
|
+++ b/src/pcre2_study.c
|
|
@@ -7,7 +7,7 @@ and semantics are as close as possible to those of the Perl 5 language.
|
|
|
|
Written by Philip Hazel
|
|
Original API code Copyright (c) 1997-2012 University of Cambridge
|
|
- New API code Copyright (c) 2016-2019 University of Cambridge
|
|
+ New API code Copyright (c) 2016-2020 University of Cambridge
|
|
|
|
-----------------------------------------------------------------------------
|
|
Redistribution and use in source and binary forms, with or without
|
|
@@ -58,7 +58,7 @@ collecting data (e.g. minimum matching length). */
|
|
|
|
/* Returns from set_start_bits() */
|
|
|
|
-enum { SSB_FAIL, SSB_DONE, SSB_CONTINUE, SSB_UNKNOWN };
|
|
+enum { SSB_FAIL, SSB_DONE, SSB_CONTINUE, SSB_UNKNOWN, SSB_TOODEEP };
|
|
|
|
|
|
/*************************************************
|
|
@@ -924,19 +924,24 @@ The SSB_CONTINUE return is useful for parenthesized groups in patterns such as
|
|
must continue at the outer level to find at least one mandatory code unit. At
|
|
the outermost level, this function fails unless the result is SSB_DONE.
|
|
|
|
+We restrict recursion (for nested groups) to 1000 to avoid stack overflow
|
|
+issues.
|
|
+
|
|
Arguments:
|
|
re points to the compiled regex block
|
|
code points to an expression
|
|
utf TRUE if in UTF mode
|
|
+ depthptr pointer to recurse depth
|
|
|
|
Returns: SSB_FAIL => Failed to find any starting code units
|
|
SSB_DONE => Found mandatory starting code units
|
|
SSB_CONTINUE => Found optional starting code units
|
|
SSB_UNKNOWN => Hit an unrecognized opcode
|
|
+ SSB_TOODEEP => Recursion is too deep
|
|
*/
|
|
|
|
static int
|
|
-set_start_bits(pcre2_real_code *re, PCRE2_SPTR code, BOOL utf)
|
|
+set_start_bits(pcre2_real_code *re, PCRE2_SPTR code, BOOL utf, int *depthptr)
|
|
{
|
|
uint32_t c;
|
|
int yield = SSB_DONE;
|
|
@@ -947,6 +952,9 @@ int table_limit = utf? 16:32;
|
|
int table_limit = 32;
|
|
#endif
|
|
|
|
+*depthptr += 1;
|
|
+if (*depthptr > 1000) return SSB_TOODEEP;
|
|
+
|
|
do
|
|
{
|
|
BOOL try_next = TRUE;
|
|
@@ -1103,13 +1111,17 @@ do
|
|
case OP_SCRIPT_RUN:
|
|
case OP_ASSERT:
|
|
case OP_ASSERT_NA:
|
|
- rc = set_start_bits(re, tcode, utf);
|
|
- if (rc == SSB_FAIL || rc == SSB_UNKNOWN) return rc;
|
|
- if (rc == SSB_DONE) try_next = FALSE; else
|
|
+ rc = set_start_bits(re, tcode, utf, depthptr);
|
|
+ if (rc == SSB_DONE)
|
|
+ {
|
|
+ try_next = FALSE;
|
|
+ }
|
|
+ else if (rc == SSB_CONTINUE)
|
|
{
|
|
do tcode += GET(tcode, 1); while (*tcode == OP_ALT);
|
|
tcode += 1 + LINK_SIZE;
|
|
}
|
|
+ else return rc; /* FAIL, UNKNOWN, or TOODEEP */
|
|
break;
|
|
|
|
/* If we hit ALT or KET, it means we haven't found anything mandatory in
|
|
@@ -1155,8 +1167,8 @@ do
|
|
case OP_BRAZERO:
|
|
case OP_BRAMINZERO:
|
|
case OP_BRAPOSZERO:
|
|
- rc = set_start_bits(re, ++tcode, utf);
|
|
- if (rc == SSB_FAIL || rc == SSB_UNKNOWN) return rc;
|
|
+ rc = set_start_bits(re, ++tcode, utf, depthptr);
|
|
+ if (rc == SSB_FAIL || rc == SSB_UNKNOWN || rc == SSB_TOODEEP) return rc;
|
|
do tcode += GET(tcode,1); while (*tcode == OP_ALT);
|
|
tcode += 1 + LINK_SIZE;
|
|
break;
|
|
@@ -1664,7 +1676,8 @@ code units. */
|
|
|
|
if ((re->flags & (PCRE2_FIRSTSET|PCRE2_STARTLINE)) == 0)
|
|
{
|
|
- int rc = set_start_bits(re, code, utf);
|
|
+ int depth = 0;
|
|
+ int rc = set_start_bits(re, code, utf, &depth);
|
|
if (rc == SSB_UNKNOWN) return 1;
|
|
|
|
/* If a list of starting code units was set up, scan the list to see if only
|
|
--
|
|
2.21.1
|
|
|