Attachment 261501 Details for Bug 315881 – Patch backported to pcre-3.4 in EL2.1

[patch] Patch backported to pcre-3.4 in EL2.1

pcre-3.4-CVE-2007-1660.patch (text/plain), 2.81 KB, created by Tomas Hoger on 2007-11-16 17:20:21 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomas Hoger

Created: 2007-11-16 17:20:21 UTC

Size: 2.81 KB

patch

obsolete

>diff -pruN pcre-3.4.orig/config.in pcre-3.4/config.in
>--- pcre-3.4.orig/config.in	2007-11-16 17:58:45.000000000 +0100
>+++ pcre-3.4/config.in	2007-11-16 18:09:36.000000000 +0100
>@@ -30,6 +30,14 @@ found. If HAVE_MEMMOVE is set to 1, the 
> #define HAVE_MEMMOVE  0
> #define HAVE_BCOPY    0
> 
>+/* The value of NEWLINE determines the newline character. The default is to
>+leave it up to the compiler, but some sites want to force a particular value.
>+On Unix systems, "configure" can be used to override this default. */
>+
>+#ifndef NEWLINE
>+#define NEWLINE '\n'
>+#endif
>+
> #ifndef MAX_DUPLENGTH
> #define MAX_DUPLENGTH 30000
> #endif
>diff -pruN pcre-3.4.orig/pcre.c pcre-3.4/pcre.c
>--- pcre-3.4.orig/pcre.c	2007-11-16 17:58:45.000000000 +0100
>+++ pcre-3.4/pcre.c	2007-11-16 18:03:41.000000000 +0100
>@@ -2497,6 +2497,7 @@ const uschar *ptr;
> compile_data compile_block;
> int brastack[BRASTACK_SIZE];
> uschar bralenstack[BRASTACK_SIZE];
>+int newoptions = options;
> 
> #ifdef DEBUG
> uschar *code_base, *code_end;
>@@ -2856,6 +2857,7 @@ while ((c = *(++ptr)) != 0)
>             character" code. */
> 
>             case ':':
>+           newoptions = (options | set) & (~unset);
>             if (((set|unset) & PCRE_IMS) != 0)
>               {
>               length += 4;
>@@ -2944,6 +2946,25 @@ while ((c = *(++ptr)) != 0)
>       /* Leave ptr at the final char; for read_repeat_counts this happens
>       automatically; for the others we need an increment. */
> 
>+     c = ptr[1];
>+     if ((newoptions & PCRE_EXTENDED) != 0) 
>+       {
>+        while(c) {
>+          while(c && (compile_block.ctypes[c] & ctype_space) != 0) 
>+            {
>+              c = *(++ptr + 1);
>+            }
>+          if (c == '#')
>+            {
>+              /* The space before the ; is to avoid a warning on a silly compiler
>+                 on the Macintosh. */
>+              while ((c = *(++ptr + 1)) != 0 && c != NEWLINE) ;
>+              continue;
>+            }
>+          break;
>+        }
>+       }
>+ 
>       if ((c = ptr[1]) == '{' && is_counted_repeat(ptr+2, &compile_block))
>         {
>         ptr = read_repeat_counts(ptr+2, &minval, &maxval, errorptr,
>@@ -2962,7 +2983,7 @@ while ((c = *(++ptr)) != 0)
>       if (minval == 0)
>         {
>         length++;
>-        if (maxval > 0) length += (maxval - 1) * (duplength + 7);
>+        if (maxval > 0) length += (maxval - 1) * (duplength + 10);
>         }
> 
>       /* When the minimum is greater than zero, 1 we have to replicate up to
>@@ -2973,9 +2994,9 @@ while ((c = *(++ptr)) != 0)
> 
>       else
>         {
>-        length += (minval - 1) * duplength;
>+        length += (minval - 1) * (duplength + 3);
>         if (maxval > minval)   /* Need this test as maxval=-1 means no limit */
>-          length += (maxval - minval) * (duplength + 7) - 6;
>+          length += (maxval - minval) * (duplength + 10) - 6;
>         }
>       }
>     continue;

Actions: View | Diff

Attachments on bug 315881: 259991 | 261501