Commit 31c31ef5 authored by Joe Orton's avatar Joe Orton
Browse files

Merge r233493 from trunk: 

* srclib/pcre/pcre.c (read_repeat_counts): Check for integer overflow.

Obtained from: pcre 6.2 upstream
Reviewed by: jorton, nd, wrowe


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@290658 13f79535-47bb-0310-9956-ffa450edef68
parent 083bfd81

CHANGES

+5 −0
Changes for CHANGES: 5 added lines, 0 removed lines.
Original line number Diff line number Diff line 
                                                         -*- coding: utf-8 -*-

Changes with Apache 2.0.55









  *) SECURITY: CAN-2005-2491 (cve.mitre.org): 









     Fix integer overflows in PCRE in quantifier parsing which could









     be triggered by a local user through use of a carefully-crafted 









     regex in an .htaccess file.  [Philip Hazel]

















  *) SECURITY: CAN-2005-2088 (cve.mitre.org)









     proxy: Correctly handle the Transfer-Encoding and Content-Length









     headers.  Discard the request Content-Length whenever T-E: chunked


































STATUS



+0
−6



























Changes for STATUS: 0 added lines, 6 removed lines.



Original line number
Diff line number
Diff line







@@ -171,12 +171,6 @@ PATCHES ACCEPTED TO BACKPORT FROM TRUNK:







       +1: pquerna, nd, wrowe









       Votes from before the integration branch: +1: jerenkrantz



















    *) Fix CAN-2005-2491, integer overflow in pcre.









         http://svn.apache.org/viewcvs?rev=233493&view=rev









       rediff for 2.0: http://people.apache.org/~jorton/CAN-2005-2491.patch









       test case: perl-framework/t/security/CAN-2005-2491.t









       +1: jorton, nd, wrowe



















PATCHES PROPOSED TO BACKPORT FROM TRUNK:









  [ please place SVN revisions from trunk here, so it is easy to









    identify exactly what the proposed changes are!  Add all new


































srclib/pcre/pcre.c



+18
−7



























Changes for srclib/pcre/pcre.c: 18 added lines, 7 removed lines.



Original line number
Diff line number
Diff line







@@ -714,7 +714,18 @@ read_repeat_counts(const uschar *p, int *minp, int *maxp,







int min = 0;









int max = -1;



















/* Read the minimum value and do a paranoid check: a negative value indicates









an integer overflow. */



















while ((cd->ctypes[*p] & ctype_digit) != 0) min = min * 10 + *p++ - '0';









if (min < 0 || min > 65535)









  {









  *errorptr = ERR5;









  return p;









  }



















/* Read the maximum value if there is one, and again do a paranoid on its size.









Also, max must not be less than min. */



















if (*p == '}') max = min; else









  {










@@ -722,6 +733,11 @@ if (*p == '}') max = min; else







    {









    max = 0;









    while((cd->ctypes[*p] & ctype_digit) != 0) max = max * 10 + *p++ - '0';









    if (max < 0 || max > 65535)









      {









      *errorptr = ERR5;









      return p;









      }









    if (max < min)









      {









      *errorptr = ERR4;










@@ -730,16 +746,11 @@ if (*p == '}') max = min; else







    }









  }



















/* Do paranoid checks, then fill in the required variables, and pass back the









pointer to the terminating '}'. */









/* Fill in the required variables, and pass back the pointer to the terminating









'}'. */



















if (min > 65535 || max > 65535)









  *errorptr = ERR5;









else









  {









*minp = min;









*maxp = max;









  }









return p;









}