6a732960a0
library) from ubuntu Linux (via gentoo). For details see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2491
69 lines
1.8 KiB
Text
69 lines
1.8 KiB
Text
$NetBSD: patch-ec,v 1.1 2005/10/01 19:59:39 recht Exp $
|
|
|
|
--- Modules/pypcre.c.orig 2002-03-16 18:58:21.000000000 +0100
|
|
+++ Modules/pypcre.c 2005-10-01 21:38:57.000000000 +0200
|
|
@@ -1162,14 +1162,31 @@
|
|
int min = 0;
|
|
int max = -1;
|
|
|
|
+/* Read the minimum value and do a paranoid check: a negative value indicates
|
|
+an integer overflow. */
|
|
+
|
|
while ((pcre_ctypes[*p] & ctype_digit) != 0) min = min * 10 + *p++ - '0';
|
|
|
|
+if (min < 0 || min > 65535)
|
|
+ {
|
|
+ *errorptr = ERR5;
|
|
+ return p;
|
|
+ }
|
|
+
|
|
+/* Read the maximum value if there is one, and again do a paranoid on its size
|
|
+. Also, max must not be less than min. */
|
|
+
|
|
if (*p == '}') max = min; else
|
|
{
|
|
if (*(++p) != '}')
|
|
{
|
|
max = 0;
|
|
while((pcre_ctypes[*p] & ctype_digit) != 0) max = max * 10 + *p++ - '0';
|
|
+ if (max < 0 || max > 65535)
|
|
+ {
|
|
+ *errorptr = ERR5;
|
|
+ return p;
|
|
+ }
|
|
if (max < min)
|
|
{
|
|
*errorptr = ERR4;
|
|
@@ -2266,6 +2283,7 @@
|
|
int bracount = 0;
|
|
int brastack[200];
|
|
int top_backref = 0;
|
|
+BOOL capturing;
|
|
unsigned int brastackptr = 0;
|
|
uschar *code;
|
|
const uschar *ptr;
|
|
@@ -2445,6 +2463,7 @@
|
|
/* Brackets may be genuine groups or special things */
|
|
|
|
case '(':
|
|
+ capturing = FALSE;
|
|
|
|
/* Handle special forms of bracket, which all start (? */
|
|
|
|
@@ -2542,10 +2561,15 @@
|
|
continue; /* End of this bracket handling */
|
|
}
|
|
|
|
+ /* Ordinary parentheses, not followed by '?', are capturing unless
|
|
+ PCRE_NO_AUTO_CAPTURE is set. */
|
|
+
|
|
+ else capturing = (options & PCRE_NO_AUTO_CAPTURE) == 0;
|
|
+
|
|
/* Extracting brackets must be counted so we can process escapes in a
|
|
Perlish way. */
|
|
|
|
- else bracount++;
|
|
+ if (capturing) bracount++;
|
|
|
|
/* Non-special forms of bracket. Save length for computing whole length
|
|
at end if there's a repeat that requires duplication of the group. */
|