92 lines
3.4 KiB
Diff
92 lines
3.4 KiB
Diff
From 439a3bfe85749ea9eca31372daec5705acaa3db1 Mon Sep 17 00:00:00 2001
|
||
From: Karl Williamson <khw@cpan.org>
|
||
Date: Sat, 24 Aug 2019 19:17:19 -0600
|
||
Subject: [PATCH] PATCH: [perl #134325] Heap buffer overflow
|
||
MIME-Version: 1.0
|
||
Content-Type: text/plain; charset=UTF-8
|
||
Content-Transfer-Encoding: 8bit
|
||
|
||
This was the result of trying to continue to parse after realizing that
|
||
we were going to have to reparse using long jumps. This continuing only
|
||
happened when we realized we were going to have to reparse in order to
|
||
count parentheses anyway, and it was an attempt to save a pass in the
|
||
regex compiler, as without doing the continuing we'd restart the parse
|
||
to use long jumps from the beginning, and then when finished, would
|
||
restart the parse to count the parentheses.
|
||
|
||
However, in most cases this doesn't help, as when we get towards the end
|
||
of the parse (as in the test case in this ticket), we need the long
|
||
jump, and will segfault because we don't have it. So we need the extra
|
||
pass anyway.
|
||
|
||
So this commit restarts the parse as soon as we discover we are going to
|
||
need longjumps
|
||
|
||
Signed-off-by: Petr Písař <ppisar@redhat.com>
|
||
---
|
||
regcomp.c | 8 ++------
|
||
t/re/pat.t | 14 ++++++++++++--
|
||
2 files changed, 14 insertions(+), 8 deletions(-)
|
||
|
||
diff --git a/regcomp.c b/regcomp.c
|
||
index 05dd9a5e7b..abb029f8c0 100644
|
||
--- a/regcomp.c
|
||
+++ b/regcomp.c
|
||
@@ -377,12 +377,8 @@ struct RExC_state_t {
|
||
#define REQUIRE_BRANCHJ(flagp, restart_retval) \
|
||
STMT_START { \
|
||
RExC_use_BRANCHJ = 1; \
|
||
- if (LIKELY(! IN_PARENS_PASS)) { \
|
||
- /* No need to restart the parse immediately if we're \
|
||
- * going to reparse anyway to count parens */ \
|
||
- *flagp |= RESTART_PARSE; \
|
||
- return restart_retval; \
|
||
- } \
|
||
+ *flagp |= RESTART_PARSE; \
|
||
+ return restart_retval; \
|
||
} STMT_END
|
||
|
||
/* Until we have completed the parse, we leave RExC_total_parens at 0 or
|
||
diff --git a/t/re/pat.t b/t/re/pat.t
|
||
index e54affcd94..6a868f4bcd 100644
|
||
--- a/t/re/pat.t
|
||
+++ b/t/re/pat.t
|
||
@@ -25,7 +25,7 @@ BEGIN {
|
||
skip_all('no re module') unless defined &DynaLoader::boot_DynaLoader;
|
||
skip_all_without_unicode_tables();
|
||
|
||
-plan tests => 863; # Update this when adding/deleting tests.
|
||
+plan tests => 864; # Update this when adding/deleting tests.
|
||
|
||
run_tests() unless caller;
|
||
|
||
@@ -33,7 +33,6 @@ run_tests() unless caller;
|
||
# Tests start here.
|
||
#
|
||
sub run_tests {
|
||
-
|
||
my $sharp_s = uni_to_native("\xdf");
|
||
|
||
{
|
||
@@ -2105,6 +2104,17 @@ x{0c!}\;\;îçÿ /0f/! F /;îçÿù\Q xÿÿÿÿ ù `x{0c!}; ù\Q
|
||
eval $z;:, "", {}, 'foo');
|
||
}
|
||
|
||
+ { # [perl #134325]
|
||
+ my $quote="\\Q";
|
||
+ my $back="\\\\";
|
||
+ my $ff="\xff";
|
||
+ my $s = sprintf "/\\1|(|%s)%s%s /i",
|
||
+ $quote x 8 . $back x 69,
|
||
+ $quote x 5 . $back x 4,
|
||
+ $ff x 48;
|
||
+ like(runperl(prog => "$s", stderr => 1), qr/Unmatched \(/);
|
||
+ }
|
||
+
|
||
} # End of sub run_tests
|
||
|
||
1;
|
||
--
|
||
2.21.0
|
||
|