d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Disallow pattern spaces which would cause intermediate calculations to

Browse Source 
overflow size_t.

Obtained from:	DragonFly (2841837793bd095a82f477e9c370cfe6cfb3862c dillon)
Security:	CERT VU#695940
MFC after:	3 days
This commit is contained in:
Xin LI 2015-02-14 00:23:53 +00:00
parent c537027e53
commit a89629abd9
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=278739
1 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
lib/libc/regex/regcomp.c
View File

@ -192,6 +192,7 @@ regcomp(regex_t * __restrict preg,
struct parse *p = &pa;
int i;
size_t len;
size_t maxlen;
#ifdef REDEBUG
# define GOODFLAGS(f) (f)
#else
@ -213,7 +214,23 @@ regcomp(regex_t * __restrict preg,
g = (struct re_guts *)malloc(sizeof(struct re_guts));
if (g == NULL)
return(REG_ESPACE);
/*
* Limit the pattern space to avoid a 32-bit overflow on buffer
* extension. Also avoid any signed overflow in case of conversion
* so make the real limit based on a 31-bit overflow.
*
* Likely not applicable on 64-bit systems but handle the case
* generically (who are we to stop people from using ~715MB+
* patterns?).
*/
maxlen = ((size_t)-1 >> 1) / sizeof(sop) * 2 / 3;
if (len >= maxlen) {
free((char *)g);
return(REG_ESPACE);
}
p->ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */
assert(p->ssize >= len);
p->strip = (sop *)malloc(p->ssize * sizeof(sop));
p->slen = 0;
if (p->strip == NULL) {