Attachment 259991 Details for Bug 315881 – Patch backported to pcre-3.9 in EL3

[patch] Patch backported to pcre-3.9 in EL3

pcre-3.9-CVE-2007-1660.patch (text/plain), 2.15 KB, created by Tomas Hoger on 2007-11-15 16:41:29 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomas Hoger

Created: 2007-11-15 16:41:29 UTC

Size: 2.15 KB

patch

obsolete

>--- pcre-3.9.orig/pcre.c	2007-11-15 14:01:35.000000000 +0100
>+++ pcre-3.9/pcre.c	2007-11-15 14:11:11.000000000 +0100
>@@ -2504,6 +2504,7 @@ const uschar *ptr;
> compile_data compile_block;
> int brastack[BRASTACK_SIZE];
> uschar bralenstack[BRASTACK_SIZE];
>+int newoptions = options;
> 
> #ifdef DEBUG
> uschar *code_base, *code_end;
>@@ -2865,6 +2866,7 @@ while ((c = *(++ptr)) != 0)
>             character" code. */
> 
>             case ':':
>+           newoptions = (options | set) & (~unset);
>             if (((set|unset) & PCRE_IMS) != 0)
>               {
>               length += 4;
>@@ -2958,6 +2960,25 @@ while ((c = *(++ptr)) != 0)
>       /* Leave ptr at the final char; for read_repeat_counts this happens
>       automatically; for the others we need an increment. */
> 
>+     c = ptr[1];
>+     if ((newoptions & PCRE_EXTENDED) != 0) 
>+       {
>+        while(c) {
>+          while(c && (compile_block.ctypes[c] & ctype_space) != 0) 
>+            {
>+              c = *(++ptr + 1);
>+            }
>+          if (c == '#')
>+            {
>+              /* The space before the ; is to avoid a warning on a silly compiler
>+                 on the Macintosh. */
>+              while ((c = *(++ptr + 1)) != 0 && c != NEWLINE) ;
>+              continue;
>+            }
>+          break;
>+        }
>+       }
>+ 
>       if ((c = ptr[1]) == '{' && is_counted_repeat(ptr+2, &compile_block))
>         {
>         ptr = read_repeat_counts(ptr+2, &minval, &maxval, errorptr,
>@@ -2976,7 +2997,7 @@ while ((c = *(++ptr)) != 0)
>       if (minval == 0)
>         {
>         length++;
>-        if (maxval > 0) length += (maxval - 1) * (duplength + 7);
>+        if (maxval > 0) length += (maxval - 1) * (duplength + 10);
>         }
> 
>       /* When the minimum is greater than zero, 1 we have to replicate up to
>@@ -2987,9 +3008,9 @@ while ((c = *(++ptr)) != 0)
> 
>       else
>         {
>-        length += (minval - 1) * duplength;
>+        length += (minval - 1) * (duplength + 3);
>         if (maxval > minval)   /* Need this test as maxval=-1 means no limit */
>-          length += (maxval - minval) * (duplength + 7) - 6;
>+          length += (maxval - minval) * (duplength + 10) - 6;
>         }
>       }
>     continue;

Actions: View | Diff

Attachments on bug 315881: 259991 | 261501