diff options
| author | Paul Eggert <eggert@cs.ucla.edu> | 2015-09-19 13:53:34 -0700 |
|---|---|---|
| committer | DongHun Kwak <dh0128.kwak@samsung.com> | 2021-02-16 10:46:48 +0900 |
| commit | 7c0dcc0f89813734253849b0e850cec88c82b34c (patch) | |
| tree | 1bf51c202c40a2c74f51c9670015c2aab0c7e57a | |
| parent | 01ec76b9eb113348c2811dead462eac319864d5f (diff) | |
| download | diffutils-7c0dcc0f89813734253849b0e850cec88c82b34c.tar.gz diffutils-7c0dcc0f89813734253849b0e850cec88c82b34c.tar.bz2 diffutils-7c0dcc0f89813734253849b0e850cec88c82b34c.zip | |
[CVE-2009-5155] Diagnose ERE '()|\1'tizen_7.0_m2_releasetizen_6.5.m2_releasesubmit/tizen_base/20210216.020958submit/tizen_7.0_base_hotfix/20221115.161501submit/tizen_7.0_base/20221028.200901submit/tizen_6.5_base/20211027.200501submit/tizen_6.5_base/20211027.183101submit/tizen_6.5_base/20211026.180901submit/sandbox/backup/diffutils_3.3_20221227/20230105.055728accepted/tizen/base/tool/20210221.221005accepted/tizen/7.0/base/tool/hotfix/20221115.084857accepted/tizen/7.0/base/tool/20221028.113107accepted/tizen/7.0/base/hotfix/20230714.003710accepted/tizen/7.0/base/20230714.002855accepted/tizen/6.5/base/tool/20211027.112245accepted/tizen/6.5/base/20230714.002446tizen_7.0_base_hotfixtizen_7.0_basetizen_6.5_basesandbox/backup/diffutils_3.3_20221227accepted/tizen_7.0_base_tool_hotfixaccepted/tizen_7.0_base_toolaccepted/tizen_7.0_base_hotfixaccepted/tizen_7.0_baseaccepted/tizen_6.5_base_toolaccepted/tizen_6.5_base
Problem reported by Hanno Böck in: http://bugs.gnu.org/21513
* lib/regcomp.c (parse_reg_exp): While parsing alternatives, keep
track of the set of previously-completed subexpressions available
before the first alternative, and restore this set just before
parsing each subsequent alternative. This lets us diagnose the
invalid back-reference in the ERE '()|\1'.
Change-Id: I33d1ba3c5c4e3460b81cda46eac2a4eac625b8c3
Signed-off-by: DongHun Kwak <dh0128.kwak@samsung.com>
| -rw-r--r-- | lib/regcomp.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/lib/regcomp.c b/lib/regcomp.c index f7cfebe..63f08c1 100644 --- a/lib/regcomp.c +++ b/lib/regcomp.c @@ -2182,6 +2182,7 @@ parse_reg_exp (re_string_t *regexp, regex_t *preg, re_token_t *token, { re_dfa_t *dfa = preg->buffer; bin_tree_t *tree, *branch = NULL; + bitset_word_t initial_bkref_map = dfa->completed_bkref_map; tree = parse_branch (regexp, preg, token, syntax, nest, err); if (BE (*err != REG_NOERROR && tree == NULL, 0)) return NULL; @@ -2192,9 +2193,16 @@ parse_reg_exp (re_string_t *regexp, regex_t *preg, re_token_t *token, if (token->type != OP_ALT && token->type != END_OF_RE && (nest == 0 || token->type != OP_CLOSE_SUBEXP)) { + bitset_word_t accumulated_bkref_map = dfa->completed_bkref_map; + dfa->completed_bkref_map = initial_bkref_map; branch = parse_branch (regexp, preg, token, syntax, nest, err); if (BE (*err != REG_NOERROR && branch == NULL, 0)) - return NULL; + { + if (tree != NULL) + postorder (tree, free_tree, NULL); + return NULL; + } + dfa->completed_bkref_map |= accumulated_bkref_map; } else branch = NULL; |