archive/ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2025-08-23 21:14:23 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Port a Oniguruma patch: Integer overflow in forward_search_range()

Browse source 
db64ef3189

Co-Authored-By: K.Kosako <kkos@users.noreply.github.com>
This commit is contained in:
TSUYUSATO Kitsune 2025-07-28 16:05:41 +09:00 • committed by Takashi Kokubun
parent 8b505a2860
commit 9f45db04ac
1 changed files with 10 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

16
regexec.c
View file

@ -4932,14 +4932,14 @@ forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s,
}
p = s;
if (reg->dmin > 0) {
if (reg->dmin != 0) {
if (end - p <= reg->dmin) return 0; /* fail */
if (ONIGENC_IS_SINGLEBYTE(reg->enc)) {
p += reg->dmin;
}
else {
UChar *q = p + reg->dmin;
if (q >= end) return 0; /* fail */
while (p < q) p += enclen(reg->enc, p, end);
}
}
@ -4976,7 +4976,7 @@ forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s,
}
if (p && p < range) {
if (p - reg->dmin < s) {
if (p - s < reg->dmin) {
retry_gate:
pprev = p;
p += enclen(reg->enc, p, end);
@ -5020,10 +5020,11 @@ forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s,
*low_prev = onigenc_get_prev_char_head(reg->enc,
(pprev ? pprev : str), p, end);
}
*high = p;
}
else {
if (reg->dmax != ONIG_INFINITE_DISTANCE) {
if (p < str + reg->dmax) {
if (p - str < reg->dmax) {
*low = (UChar* )str;
if (low_prev)
*low_prev = onigenc_get_prev_char_head(reg->enc, str, *low, end);
@ -5044,9 +5045,12 @@ forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s,
}
}
}
/* no needs to adjust *high, *high is used as range check only */
if (p - str < reg->dmin)
*high = (UChar* )str;
else
*high = p - reg->dmin;
}
/* no needs to adjust *high, *high is used as range check only */
*high = p - reg->dmin;
#ifdef ONIG_DEBUG_SEARCH
fprintf(stderr,