Disallow pattern spaces which would cause intermediate calculations to
overflow size_t. Obtained from: DragonFly (2841837793bd095a82f477e9c370cfe6cfb3862c dillon) Security: CERT VU#695940 MFC after: 3 days
This commit is contained in:
parent
c537027e53
commit
a89629abd9
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=278739
@ -192,6 +192,7 @@ regcomp(regex_t * __restrict preg,
|
||||
struct parse *p = &pa;
|
||||
int i;
|
||||
size_t len;
|
||||
size_t maxlen;
|
||||
#ifdef REDEBUG
|
||||
# define GOODFLAGS(f) (f)
|
||||
#else
|
||||
@ -213,7 +214,23 @@ regcomp(regex_t * __restrict preg,
|
||||
g = (struct re_guts *)malloc(sizeof(struct re_guts));
|
||||
if (g == NULL)
|
||||
return(REG_ESPACE);
|
||||
/*
|
||||
* Limit the pattern space to avoid a 32-bit overflow on buffer
|
||||
* extension. Also avoid any signed overflow in case of conversion
|
||||
* so make the real limit based on a 31-bit overflow.
|
||||
*
|
||||
* Likely not applicable on 64-bit systems but handle the case
|
||||
* generically (who are we to stop people from using ~715MB+
|
||||
* patterns?).
|
||||
*/
|
||||
maxlen = ((size_t)-1 >> 1) / sizeof(sop) * 2 / 3;
|
||||
if (len >= maxlen) {
|
||||
free((char *)g);
|
||||
return(REG_ESPACE);
|
||||
}
|
||||
p->ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */
|
||||
assert(p->ssize >= len);
|
||||
|
||||
p->strip = (sop *)malloc(p->ssize * sizeof(sop));
|
||||
p->slen = 0;
|
||||
if (p->strip == NULL) {
|
||||
|
Loading…
Reference in New Issue
Block a user