diff options
| author | Paul Eggert <eggert@cs.ucla.edu> | 2015-09-19 13:53:34 -0700 |
|---|---|---|
| committer | DongHun Kwak <dh0128.kwak@samsung.com> | 2023-01-12 11:31:51 +0900 |
| commit | b6153c642c104f5769c1e9949453fe9e7388e50f (patch) | |
| tree | e1488090f524d29a873e7786f2fd9f04e8f8ac3c | |
| parent | 42a04cb81533de4c8b7d67a70b94b944eb122fc8 (diff) | |
| download | sed-tizen_6.0_base.tar.gz sed-tizen_6.0_base.tar.bz2 sed-tizen_6.0_base.zip | |
[CVE-2009-5155] Diagnose ERE '()|\1'submit/tizen_6.0_base/20230112.235435accepted/tizen/6.0/base/tool/20230116.011858accepted/tizen/6.0/base/20230713.143147tizen_6.0_baseaccepted/tizen_6.0_base_toolaccepted/tizen_6.0_base
Problem reported by Hanno Böck in: http://bugs.gnu.org/21513
* lib/regcomp.c (parse_reg_exp): While parsing alternatives, keep
track of the set of previously-completed subexpressions available
before the first alternative, and restore this set just before
parsing each subsequent alternative. This lets us diagnose the
invalid back-reference in the ERE '()|\1'.
Change-Id: I84f72e7db3e822142d9c2326b843b50d84f3e4f0
Signed-off-by: DongHun Kwak <dh0128.kwak@samsung.com>
| -rw-r--r-- | lib/regcomp.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/lib/regcomp.c b/lib/regcomp.c index 6e317f5..243129f 100644 --- a/lib/regcomp.c +++ b/lib/regcomp.c @@ -2138,6 +2138,7 @@ parse_reg_exp (re_string_t *regexp, regex_t *preg, re_token_t *token, { re_dfa_t *dfa = (re_dfa_t *) preg->buffer; bin_tree_t *tree, *branch = NULL; + bitset_word_t initial_bkref_map = dfa->completed_bkref_map; tree = parse_branch (regexp, preg, token, syntax, nest, err); if (BE (*err != REG_NOERROR && tree == NULL, 0)) return NULL; @@ -2148,9 +2149,12 @@ parse_reg_exp (re_string_t *regexp, regex_t *preg, re_token_t *token, if (token->type != OP_ALT && token->type != END_OF_RE && (nest == 0 || token->type != OP_CLOSE_SUBEXP)) { + bitset_word_t accumulated_bkref_map = dfa->completed_bkref_map; + dfa->completed_bkref_map = initial_bkref_map; branch = parse_branch (regexp, preg, token, syntax, nest, err); if (BE (*err != REG_NOERROR && branch == NULL, 0)) return NULL; + dfa->completed_bkref_map |= accumulated_bkref_map; } else branch = NULL; |