Skip to content

Commit 897d1f7

Browse files
John Lightseysteve-m-hay
John Lightsey
authored andcommitted
regcomp.c: Prevent integer overflow from nested regex quantifiers.
(CVE-2020-10543) On 32bit systems the size calculations for nested regular expression quantifiers could overflow causing heap memory corruption. Fixes: Perl/perl-security#125 (cherry picked from commit bfd31397db5dc1a5c5d3e0a1f753a4f89a736e71)
1 parent 7ece593 commit 897d1f7

File tree

1 file changed

+6
-0
lines changed

1 file changed

+6
-0
lines changed

Diff for: regcomp.c

+6
Original file line numberDiff line numberDiff line change
@@ -5489,6 +5489,12 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
54895489
RExC_precomp)));
54905490
}
54915491

5492+
if ( ( minnext > 0 && mincount >= SSize_t_MAX / minnext )
5493+
|| min >= SSize_t_MAX - minnext * mincount )
5494+
{
5495+
FAIL("Regexp out of space");
5496+
}
5497+
54925498
min += minnext * mincount;
54935499
is_inf_internal |= deltanext == SSize_t_MAX
54945500
|| (maxcount == REG_INFTY && minnext + deltanext > 0);

0 commit comments

Comments
 (0)