26 lines
1.0 KiB
Diff
26 lines
1.0 KiB
Diff
|
Description: CVE-2014-8964, heap buffer overflow
|
||
|
|
Heap buffer overflow if an assertion with a zero minimum repeat is used as
|
||
|
|
the condition in a conditional group.
|
||
|
|
Origin: upstream http://bugs.exim.org/show_bug.cgi?id=1546
|
||
|
|
Bug: http://bugs.exim.org/show_bug.cgi?id=1546
|
||
|
|
Applied-Upstream: Yes, after 8.36
|
||
|
|
|
||
|
|
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
|
||
|
|
---
|
||
|
|
This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
|
||
|
|
--- a/pcre_exec.c
|
||
|
|
+++ b/pcre_exec.c
|
||
|
|
@@ -1404,8 +1404,11 @@
|
||
|
|
condition = TRUE;
|
||
|
|
|
||
|
|
/* Advance ecode past the assertion to the start of the first branch,
|
||
|
|
- but adjust it so that the general choosing code below works. */
|
||
|
|
+ but adjust it so that the general choosing code below works. If the
|
||
|
|
+ assertion has a quantifier that allows zero repeats we must skip over
|
||
|
|
+ the BRAZERO. This is a lunatic thing to do, but somebody did! */
|
||
|
|
|
||
|
|
+ if (*ecode == OP_BRAZERO) ecode++;
|
||
|
|
ecode += GET(ecode, 1);
|
||
|
|
while (*ecode == OP_ALT) ecode += GET(ecode, 1);
|
||
|
|
ecode += 1 + LINK_SIZE - PRIV(OP_lengths)[condcode];
|