archive/ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2025-08-23 21:14:23 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Port a Oniguruma patch: Integer overflow in forward_search_range()

Browse source 
db64ef3189

Co-Authored-By: K.Kosako <kkos@users.noreply.github.com>
This commit is contained in:
TSUYUSATO Kitsune 2025-07-28 16:05:41 +09:00 • committed by Takashi Kokubun
parent 8b505a2860
commit 9f45db04ac
1 changed files with 10 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

16
regexec.c
View file

@ -4932,14 +4932,14 @@ forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s,
} }
p = s; p = s;
if (reg->dmin > 0) { if (reg->dmin != 0) {
if (end - p <= reg->dmin) return 0; /* fail */
if (ONIGENC_IS_SINGLEBYTE(reg->enc)) { if (ONIGENC_IS_SINGLEBYTE(reg->enc)) {
p += reg->dmin; p += reg->dmin;
} }
else { else {
UChar *q = p + reg->dmin; UChar *q = p + reg->dmin;
if (q >= end) return 0; /* fail */
while (p < q) p += enclen(reg->enc, p, end); while (p < q) p += enclen(reg->enc, p, end);
} }
} }
@ -4976,7 +4976,7 @@ forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s,
} }
if (p && p < range) { if (p && p < range) {
if (p - reg->dmin < s) { if (p - s < reg->dmin) {
retry_gate: retry_gate:
pprev = p; pprev = p;
p += enclen(reg->enc, p, end); p += enclen(reg->enc, p, end);
@ -5020,10 +5020,11 @@ forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s,
*low_prev = onigenc_get_prev_char_head(reg->enc, *low_prev = onigenc_get_prev_char_head(reg->enc,
(pprev ? pprev : str), p, end); (pprev ? pprev : str), p, end);
} }
*high = p;
} }
else { else {
if (reg->dmax != ONIG_INFINITE_DISTANCE) { if (reg->dmax != ONIG_INFINITE_DISTANCE) {
if (p < str + reg->dmax) { if (p - str < reg->dmax) {
*low = (UChar* )str; *low = (UChar* )str;
if (low_prev) if (low_prev)
*low_prev = onigenc_get_prev_char_head(reg->enc, str, *low, end); *low_prev = onigenc_get_prev_char_head(reg->enc, str, *low, end);
@ -5044,9 +5045,12 @@ forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s,
} }
} }
} }
/* no needs to adjust *high, *high is used as range check only */
if (p - str < reg->dmin)
*high = (UChar* )str;
else
*high = p - reg->dmin;
} }
/* no needs to adjust *high, *high is used as range check only */
*high = p - reg->dmin;
#ifdef ONIG_DEBUG_SEARCH #ifdef ONIG_DEBUG_SEARCH
fprintf(stderr, fprintf(stderr,