File pcre2-CVE-2022-41409.patch of Package pcre2

Overview Repositories Revisions Requests Users Attributes Meta

File pcre2-CVE-2022-41409.patch of Package pcre2

From 94e1c001761373b7d9450768aa15d04c25547a35 Mon Sep 17 00:00:00 2001
From: Philip Hazel <Philip.Hazel@gmail.com>
Date: Tue, 16 Aug 2022 17:00:45 +0100
Subject: [PATCH] Diagnose negative repeat value in pcre2test subject line

---
 ChangeLog            | 3 +++
 src/pcre2test.c      | 4 ++--
 testdata/testinput2  | 3 +++
 testdata/testoutput2 | 4 ++++
 4 files changed, 12 insertions(+), 2 deletions(-)

Index: pcre2-10.34/ChangeLog
===================================================================
--- pcre2-10.34.orig/ChangeLog
+++ pcre2-10.34/ChangeLog
@@ -1,6 +1,12 @@
 Change Log for PCRE2
 --------------------
 
+Version 10.41 06-December-2022
+------------------------------
+
+20. A negative repeat value in a pcre2test subject line was not being
+diagnosed, leading to infinite looping.
+
 
 Version 10.34 21-November-2019
 ------------------------------
Index: pcre2-10.34/src/pcre2test.c
===================================================================
--- pcre2-10.34.orig/src/pcre2test.c
+++ pcre2-10.34/src/pcre2test.c
@@ -6700,9 +6700,9 @@ while ((c = *p++) != 0)
       }
 
     i = (int32_t)li;
-    if (i-- == 0)
+    if (i-- <= 0)
       {
-      fprintf(outfile, "** Zero repeat not allowed\n");
+      fprintf(outfile, "** Zero or negative repeat not allowed\n");
       return PR_OK;
       }
 
Index: pcre2-10.34/testdata/testinput2
===================================================================
--- pcre2-10.34.orig/testdata/testinput2
+++ pcre2-10.34/testdata/testinput2
@@ -5772,4 +5772,7 @@ a)"xI
 /(a)?a/I
     manm
 
+--
+    \[X]{-10}
+
 # End of testinput2
Index: pcre2-10.34/testdata/testoutput2
===================================================================
--- pcre2-10.34.orig/testdata/testoutput2
+++ pcre2-10.34/testdata/testoutput2
@@ -17435,6 +17435,10 @@ Subject length lower bound = 1
     manm
  0: a
 
+--
+    \[X]{-10}
+** Zero or negative repeat not allowed
+
 # End of testinput2
 Error -70: PCRE2_ERROR_BADDATA (unknown error number)
 Error -62: bad serialized data

Places

File pcre2-CVE-2022-41409.patch of Package pcre2

Places