This is a live mirror of the Perl 5 development currently hosted at https://github.com/perl/perl5
regcomp.c: Prevent integer overflow from nested regex quantifiers.
authorJohn Lightsey <jd@cpanel.net>
Thu, 21 Nov 2019 02:02:45 +0000 (20:02 -0600)
committerSteve Hay <steve.m.hay@googlemail.com>
Mon, 1 Jun 2020 19:35:51 +0000 (20:35 +0100)
(CVE-2020-10543) On 32bit systems the size calculations for nested regular
expression quantifiers could overflow causing heap memory corruption.

Fixes: Perl/perl5-security#125
(cherry picked from commit 670c54b00a47d930431dd470e72fd7d13643e169)

regcomp.c

index 2e86496..79c909d 100644 (file)
--- a/regcomp.c
+++ b/regcomp.c
@@ -5615,6 +5615,12 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
                                  RExC_precomp)));
                 }
 
+                if ( ( minnext > 0 && mincount >= SSize_t_MAX / minnext )
+                    || min >= SSize_t_MAX - minnext * mincount )
+                {
+                    FAIL("Regexp out of space");
+                }
+
                min += minnext * mincount;
                is_inf_internal |= deltanext == OPTIMIZE_INFTY
                          || (maxcount == REG_INFTY && minnext + deltanext > 0);