aboutsummaryrefslogtreecommitdiffstats
path: root/main/pcre/CVE-2014-8964.patch
blob: cfaf064389a264db1a3569446fe2029530f1dfab (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
From db5ce1f052c354faff0b74832934659753dfaae7 Mon Sep 17 00:00:00 2001
From: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
Date: Wed, 19 Nov 2014 20:57:13 +0000
Subject: [PATCH] Fix zero-repeat assertion condition bug.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1513 2f5784b3-3f2a-0410-8824-cb99058d5e15
Signed-off-by: Petr Písař <ppisar@redhat.com>

Petr Pisar: Ported to 8.33.

Signed-off-by: Petr Písař <ppisar@redhat.com>
---
 pcre_exec.c          |  4 +++-
 testdata/testinput2  |  6 ++++++
 testdata/testoutput2 | 10 ++++++++++
 3 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/pcre_exec.c b/pcre_exec.c
index 970ed3e..a8fe12b 100644
--- a/pcre_exec.c
+++ b/pcre_exec.c
@@ -1488,7 +1488,9 @@ for (;;)
         if (md->end_offset_top > offset_top)
           offset_top = md->end_offset_top;  /* Captures may have happened */
         condition = TRUE;
-        ecode += 1 + LINK_SIZE + GET(ecode, LINK_SIZE + 2);
+        ecode += 1 + LINK_SIZE;
+        if (*ecode == OP_BRAZERO) ecode++;
+        ecode += GET(ecode, 1);
         while (*ecode == OP_ALT) ecode += GET(ecode, 1);
         }
 
diff --git a/testdata/testinput2 b/testdata/testinput2
index 3b26f4b..aba73af 100644
--- a/testdata/testinput2
+++ b/testdata/testinput2
@@ -3839,4 +3839,10 @@ backtracking verbs. --/
 
 /(((a\2)|(a*)\g<-1>))*a?/BZ
 
+"((?=(?(?=(?(?=(?(?=())))*)))))"
+    a
+
+"(?(?=)?==)(((((((((?=)))))))))"
+    a
+
 /-- End of testinput2 --/
diff --git a/testdata/testoutput2 b/testdata/testoutput2
index e884638..0dcc5f9 100644
--- a/testdata/testoutput2
+++ b/testdata/testoutput2
@@ -12689,4 +12689,14 @@ Error -21 (recursion limit exceeded)
         End
 ------------------------------------------------------------------
 
+"((?=(?(?=(?(?=(?(?=())))*)))))"
+    a
+ 0: 
+ 1: 
+ 2: 
+
+"(?(?=)?==)(((((((((?=)))))))))"
+    a
+No match
+
 /-- End of testinput2 --/
-- 
1.9.3