Skip to content

Commit

Permalink
Fix check for compile workspace overflow
Browse files Browse the repository at this point in the history
Patch from:
http://vcs.pcre.org/viewvc/code/trunk/pcre_compile.c?r1=504&r2=505&view=patch

Test case:
N = 819, re:compile([lists:duplicate(N, $(), lists:duplicate(N, $))]).

Compiling large regular expressions could overflow the workspace
buffer. Modify the test to check for a value smaller than the buffer
size.
  • Loading branch information
msantos authored and bjorng committed Apr 14, 2010
1 parent e313bb4 commit dfc73e7
Showing 1 changed file with 7 additions and 2 deletions.
9 changes: 7 additions & 2 deletions erts/emulator/pcre/pcre_compile.c
Expand Up @@ -92,6 +92,11 @@ is 4 there is plenty of room. */

#define COMPILE_WORK_SIZE (4096)

/* The overrun tests check for a slightly smaller size so that they detect the
overrun before it actually does run off the end of the data block. */

#define WORK_SIZE_CHECK (COMPILE_WORK_SIZE - 100)


/* Table for handling escaped characters in the range '0'-'z'. Positive returns
are simple data values; negative values are for special things like \d and so
Expand Down Expand Up @@ -2445,7 +2450,7 @@ for (;; ptr++)
#ifdef DEBUG
if (code > cd->hwm) cd->hwm = code; /* High water info */
#endif
if (code > cd->start_workspace + COMPILE_WORK_SIZE) /* Check for overrun */
if (code > cd->start_workspace + WORK_SIZE_CHECK) /* Check for overrun */
{
*errorcodeptr = ERR52;
goto FAILED;
Expand Down Expand Up @@ -2494,7 +2499,7 @@ for (;; ptr++)
/* In the real compile phase, just check the workspace used by the forward
reference list. */

else if (cd->hwm > cd->start_workspace + COMPILE_WORK_SIZE)
else if (cd->hwm > cd->start_workspace + WORK_SIZE_CHECK)
{
*errorcodeptr = ERR52;
goto FAILED;
Expand Down

0 comments on commit dfc73e7

Please sign in to comment.