From 9786b909f96804df50ed2ff0be0ef8c6eead4132 Mon Sep 17 00:00:00 2001 From: Alan Wu Date: Wed, 15 Nov 2023 16:09:59 -0500 Subject: [PATCH] Fix regex match cache out-of-bounds access Previously the following read and wrote 1 byte out-of-bounds: $ valgrind ruby -e 'p /(\W+)[bx]\?/i.match? "aaaaaa aaaaaaaaa aaaa aaaaaaaa aaa aaaaxaaaaaaaaaaa aaaaa aaaaaaaaaaaa a ? aaa aaaa a ?"' 2> >(grep Invalid -A 30) Because of the `match_cache_point_index + 1` in memoize_extended_match_cache_point() and check_extended_match_cache_point(), we need one more byte of space. --- regexec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/regexec.c b/regexec.c index f841fbffb5e678..4b02e7f9b567e6 100644 --- a/regexec.c +++ b/regexec.c @@ -4092,7 +4092,7 @@ match_at(regex_t* reg, const UChar* str, const UChar* end, if (num_match_cache_points >= LONG_MAX_LIMIT) { return ONIGERR_MEMORY; } - size_t match_cache_buf_length = (num_match_cache_points >> 3) + (num_match_cache_points & 7 ? 1 : 0); + size_t match_cache_buf_length = (num_match_cache_points >> 3) + (num_match_cache_points & 7 ? 1 : 0) + 1; uint8_t* match_cache_buf = (uint8_t*)xmalloc(match_cache_buf_length * sizeof(uint8_t)); if (match_cache_buf == NULL) { return ONIGERR_MEMORY;