Fix invalid state(CCS_VALUE) in parse_char_class()

CVE-2017-9228 kkos/oniguruma#60
k-takata · Jul 12, 2017 · 783b7ef · 783b7ef
1 parent ee5f2e2
commit 783b7ef
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/regparse.c b/regparse.c
@@ -4767,6 +4767,12 @@ parse_char_class(Node** np, Node** asc_np, OnigToken* tok, UChar** src, UChar* e
 	  CC_ESC_WARN(env, (UChar* )"-");
 	  goto range_end_val;
 	}
+
+	if (val_type == CCV_CLASS) {
+	  r = ONIGERR_UNMATCHED_RANGE_SPECIFIER_IN_CHAR_CLASS;
+	  goto err;
+	}
+
 	state = CCS_RANGE;
       }
       else if (state == CCS_START) {