perl/SOURCES/perl-5.24.4-Fix-heap-buffer-overflow-write-reg_node-overrun.patch

46 lines
1.9 KiB
Diff
Raw Permalink Normal View History

From df2858ea28eb2c7e00a4bd6a5ed95e4782f88333 Mon Sep 17 00:00:00 2001
From: Karl Williamson <khw@cpan.org>
Date: Mon, 24 Sep 2018 11:54:41 -0600
Subject: [PATCH 242/242] PATCH: [perl #133423] for 5.26 maint
---
regcomp.c | 1 -
t/re/reg_mesg.t | 4 ++++
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/regcomp.c b/regcomp.c
index ca47db7573..431006e855 100644
--- a/regcomp.c
+++ b/regcomp.c
@@ -14896,7 +14896,6 @@ redo_curchar:
if (UCHARAT(RExC_parse) != ')')
vFAIL("Expecting close paren for wrapper for nested extended charclass");
- RExC_parse++;
RExC_flags = save_flags;
goto handle_operand;
}
diff --git a/t/re/reg_mesg.t b/t/re/reg_mesg.t
index 39cfcf7df1..d26a7caf37 100644
--- a/t/re/reg_mesg.t
+++ b/t/re/reg_mesg.t
@@ -93,6 +93,8 @@ my $high_mixed_digit = ('A' lt '0') ? '0' : 'A';
my $colon_hex = sprintf "%02X", ord(":");
my $tab_hex = sprintf "%02X", ord("\t");
+my $bug133423 = "(?[(?^:(?[\\\x00]))\\]\x00|2[^^]\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80])R.\\670";
+
##
## Key-value pairs of code/error of code that should have fatal errors.
##
@@ -270,6 +272,7 @@ my @death =
'/(?[()-!])/' => 'Incomplete expression within \'(?[ ])\' {#} m/(?[(){#}-!])/', # [perl #126204]
'/(?[!()])/' => 'Incomplete expression within \'(?[ ])\' {#} m/(?[!(){#}])/', # [perl #126404]
'/(?<=/' => 'Sequence (?... not terminated {#} m/(?<={#}/', # [perl #128170]
+ "/$bug133423/" => "Operand with no preceding operator {#} m/(?[(?^:(?[\\]))\\{#}]|2[^^]\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80])R.\\670/",
);
# These are messages that are warnings when not strict; death under 'use re
--
2.17.1