Commit 929a32ab authored by Joe Orton's avatar Joe Orton
Browse files

Backport patch from pcre 6.2 to fix integer overflows in quantifier 

parsing:

* srclib/pcre/pcre.c (read_repeat_counts): Check for integer overflow.

Obtained from: pcre 6.2 upstream


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@233493 13f79535-47bb-0310-9956-ffa450edef68
parent d78fe64f

CHANGES

+5 −0
Original line number Diff line number Diff line 
                                                        -*- coding: utf-8 -*-

Changes with Apache 2.3.0













  *) SECURITY: CAN-2005-2491 (cve.mitre.org): 













     Fix integer overflows in PCRE in quantifier parsing which could













     be triggered by a local user through use of a carefully-crafted 













     regex in an .htaccess file.  [Philip Hazel]



























  *) mod_proxy/mod_proxy_balancer: Provide a simple, functional















     interface to add additional balancer lb selection methods















     without requiring code changes to mod_proxy/mod_proxy_balancer;

































srclib/pcre/pcre.c



+20
−9






























Original line number
Diff line number
Diff line








@@ -1247,7 +1247,18 @@ read_repeat_counts(const uschar *p, int *minp, int *maxp, const char **errorptr)













int min = 0;















int max = -1;





























/* Read the minimum value and do a paranoid check: a negative value indicates













an integer overflow. */





























while ((digitab[*p] & ctype_digit) != 0) min = min * 10 + *p++ - '0';













if (min < 0 || min > 65535)













  {













  *errorptr = ERR5;













  return p;













  }



























/* Read the maximum value if there is one, and again do a paranoid on its size.













Also, max must not be less than min. */































if (*p == '}') max = min; else















  {









@@ -1255,6 +1266,11 @@ if (*p == '}') max = min; else













    {















    max = 0;















    while((digitab[*p] & ctype_digit) != 0) max = max * 10 + *p++ - '0';













    if (max < 0 || max > 65535)













      {













      *errorptr = ERR5;













      return p;













      }















    if (max < min)















      {















      *errorptr = ERR4;









@@ -1263,16 +1279,11 @@ if (*p == '}') max = min; else













    }















  }





























/* Do paranoid checks, then fill in the required variables, and pass back the













pointer to the terminating '}'. */













/* Fill in the required variables, and pass back the pointer to the terminating













'}'. */





























if (min > 65535 || max > 65535)













  *errorptr = ERR5;













else













  {















*minp = min;















*maxp = max;













  }















return p;















}