1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
|
Author: Andreas Tille <tille@debian.org>
Last-Update: Sat, 14 Feb 2015 17:51:06 +0100
Origin: https://gitweb.dragonflybsd.org/dragonfly.git/blobdiff_plain/4d133046c59a851141519d03553a70e903b3eefc..2841837793bd095a82f477e9c370cfe6cfb3862c:/lib/libc/regex/regcomp.c
Bug-Debian: http://bugs.debian.org/778397
Forwarded: sw-help@rcsb.rutgers.edu, Vladimir Guranovic <vladimir@rcsb.rutgers.edu>
Description: Henry Spencer regular expressions (regex) library contains a heap overflow vulnerability
This patch adapts the patch found at Origin (see above) to the
regex code found in librcsb-core-wrapper.
--- librcsb-core-wrapper-1.005.orig/regex/src/regcomp.c
+++ librcsb-core-wrapper-1.005/regex/src/regcomp.c
@@ -93,6 +93,7 @@ int cflags;
register struct parse *p = &pa;
register int i;
register size_t len;
+ register size_t maxlen;
#ifdef REDEBUG
# define GOODFLAGS(f) (f)
#else
@@ -115,7 +116,23 @@ int cflags;
(NC-1)*sizeof(cat_t));
if (g == NULL)
return(REG_ESPACE);
+ /*
+ * Limit the pattern space to avoid a 32-bit overflow on buffer
+ * extension. Also avoid any signed overflow in case of conversion
+ * so make the real limit based on a 31-bit overflow.
+ *
+ * Likely not applicable on 64-bit systems but handle the case
+ * generically (who are we to stop people from using ~715MB+
+ * patterns?).
+ */
+ maxlen = ((size_t)-1 >> 1) / sizeof(sop) * 2 / 3;
+ if (len >= maxlen) {
+ free((char *)g);
+ return(REG_ESPACE);
+ }
p->ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */
+ assert(p->ssize >= len);
+
p->strip = (sop *)malloc(p->ssize * sizeof(sop));
p->slen = 0;
if (p->strip == NULL) {
|
