|
- From: Matthew Vernon <matthew@debian.org>
- Date: Thu, 18 Jun 2020 19:32:51 +0100
- X-Dgit-Generated: 2:8.39-13 7b88c83f87391950756256072f886a08c44ed78f
- Subject: upstream patch fixing CVE-2020-14155
-
- This checks the size of the number after (?C as it is read, in order
- to avoid integer overflow.
-
- ---
-
- --- pcre3-8.39.orig/pcre_compile.c
- +++ pcre3-8.39/pcre_compile.c
- @@ -7086,17 +7086,19 @@ for (;; ptr++)
- int n = 0;
- ptr++;
- while(IS_DIGIT(*ptr))
- + {
- n = n * 10 + *ptr++ - CHAR_0;
- + if (n > 255)
- + {
- + *errorcodeptr = ERR38;
- + goto FAILED;
- + }
- + }
- if (*ptr != CHAR_RIGHT_PARENTHESIS)
- {
- *errorcodeptr = ERR39;
- goto FAILED;
- }
- - if (n > 255)
- - {
- - *errorcodeptr = ERR38;
- - goto FAILED;
- - }
- *code++ = n;
- PUT(code, 0, (int)(ptr - cd->start_pattern + 1)); /* Pattern offset */
- PUT(code, LINK_SIZE, 0); /* Default length */
|
