mirror of
https://git.yoctoproject.org/poky
synced 2026-04-23 09:32:17 +02:00
57b40bdd54
(From OE-Core rev: d9c5d9c52eb1f03ff9c907a76dda31042fb26edb) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
37 lines
1.3 KiB
Diff
37 lines
1.3 KiB
Diff
From 897d1f7fd515b828e4b198d8b8bef76c6faf03ed Mon Sep 17 00:00:00 2001
|
|
From: John Lightsey <jd@cpanel.net>
|
|
Date: Wed, 20 Nov 2019 20:02:45 -0600
|
|
Subject: [PATCH] regcomp.c: Prevent integer overflow from nested regex
|
|
quantifiers.
|
|
|
|
(CVE-2020-10543) On 32bit systems the size calculations for nested regular
|
|
expression quantifiers could overflow causing heap memory corruption.
|
|
|
|
Fixes: Perl/perl5-security#125
|
|
(cherry picked from commit bfd31397db5dc1a5c5d3e0a1f753a4f89a736e71)
|
|
|
|
Upstream-Status: Backport [https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed]
|
|
CVE: CVE-2020-10543
|
|
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
|
|
---
|
|
regcomp.c | 6 ++++++
|
|
1 file changed, 6 insertions(+)
|
|
|
|
diff --git a/regcomp.c b/regcomp.c
|
|
index 93c8d98fbb0..5f86be8086d 100644
|
|
--- a/regcomp.c
|
|
+++ b/regcomp.c
|
|
@@ -5489,6 +5489,12 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
|
|
RExC_precomp)));
|
|
}
|
|
|
|
+ if ( ( minnext > 0 && mincount >= SSize_t_MAX / minnext )
|
|
+ || min >= SSize_t_MAX - minnext * mincount )
|
|
+ {
|
|
+ FAIL("Regexp out of space");
|
|
+ }
|
|
+
|
|
min += minnext * mincount;
|
|
is_inf_internal |= deltanext == SSize_t_MAX
|
|
|| (maxcount == REG_INFTY && minnext + deltanext > 0);
|