rpms/tcl
7
0
Fork 0
Code Issues Pull Requests Releases Activity

CVE-2007-4772 NFA optimization cause hang in loop. Back ported patch from

Browse Source 
upstream development version.
This commit is contained in:
Marcela Mašláňová 2007-11-16 08:22:57 +00:00
parent a964e41353
commit 624e01b5d3
2 changed files with 78 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

71
tcl-8.4.15-regexp.patch Normal file
View File

@ -0,0 +1,71 @@
--- tcl8.4.15/generic/regc_nfa.c.old 1999-08-05 03:16:57.000000000 +0200
+++ tcl8.4.15/generic/regc_nfa.c 2007-11-16 09:10:18.000000000 +0100
@@ -803,6 +803,25 @@ struct arc *con;
return 1;
}
+ /*
+ * DGP 2007-11-15: Cloning a state with a circular constraint on its list
+ * of outs can lead to trouble [Bug 1810038], so get rid of them first.
+ */
+
+ for (a = from->outs; a != NULL; a = nexta) {
+ nexta = a->outchain;
+ switch (a->type) {
+ case '^':
+ case '$':
+ case BEHIND:
+ case AHEAD:
+ if (from == a->to) {
+ freearc(nfa, a);
+ }
+ break;
+ }
+ }
+
/* first, clone from state if necessary to avoid other outarcs */
if (from->nouts > 1) {
s = newstate(nfa);
@@ -921,6 +940,29 @@ struct arc *con;
return 1;
}
+ /*
+ * DGP 2007-11-15: Here we duplicate the same protections as appear
+ * in pull() above to avoid troubles with cloning a state with a
+ * circular constraint on its list of ins. It is not clear whether
+ * this is necessary, or is protecting against a "can't happen".
+ * Any test case that actually leads to a freearc() call here would
+ * be a welcome addition to the test suite.
+ */
+
+ for (a = to->ins; a != NULL; a = nexta) {
+ nexta = a->inchain;
+ switch (a->type) {
+ case '^':
+ case '$':
+ case BEHIND:
+ case AHEAD:
+ if (a->from == to) {
+ freearc(nfa, a);
+ }
+ break;
+ }
+ }
+
/* first, clone to state if necessary to avoid other inarcs */
if (to->nins > 1) {
s = newstate(nfa);
--- tcl8.4.15/tests/regexp.test.old 2003-10-14 20:22:10.000000000 +0200
+++ tcl8.4.15/tests/regexp.test 2007-11-16 09:11:13.000000000 +0100
@@ -628,6 +628,10 @@ test regexp-21.13 {multiple matches hand
regexp -all -inline -indices -line -- ^ "a\nb\nc"
} {{0 -1} {2 1} {4 3}}
+test regexp-22.1 {Bug 1810038} {
+ regexp ($|^X)* {}
+} 1
+
# cleanup
::tcltest::cleanupTests
return

8
tcl.spec
View File

@ -3,7 +3,7 @@
Summary: Tcl scripting language development environment
Name: tcl
Version: %{majorver}.15
Release: 5%{?dist}
Release: 6%{?dist}
Epoch: 1
License: TCL
Group: Development/Languages
@ -16,6 +16,7 @@ Provides: tcl(abi) = %{majorver}
##Conflicts: tcldict
Patch1: tcl-confi.patch
Patch2: tcl-8.4.7-path.patch
Patch3: tcl-8.4.15-regexp.patch
%description
The Tcl (Tool Command Language) provides a powerful platform for
@ -59,6 +60,7 @@ chmod -x generic/tclThreadAlloc.c
%patch1 -p1 -b .confi
%patch2 -p1 -b .path
%patch3 -p1 -b .regexp
%build
cd %{name}%{version}/unix
@ -142,6 +144,10 @@ rm -rf $RPM_BUILD_ROOT
%doc %{name}%{version}/html/*
%changelog
* Fri Nov 16 2007 Marcela Maslanova <mmaslano@redhat.com> - 1:8.4.15-6
- CVE-2007-4772 NFA optimization cause hang in loop. Back ported patch
from upstream development version.
* Wed Sep 26 2007 Marcela Maslanova <mmaslano@redhat.com> - 1:8.4.15-5
- fix of patch - set auto_path was broken
- Resolves: rhbz#306321