Bug 168318

+++ This bug was initially created as a clone of Bug #166335 +++

We need to determine if this issue affects Python; Python does contain it's own
version of pcre, but we didn't confirm if it used it's own version or the system
pcre library across all RHEL releases.

+++ This bug was initially created as a clone of Bug #166330 +++

PCRE 6.2 was released recently which included a fix for a heap buffer overflow.
 PCRE is used by things such as Apache but only for configuration (therefore
making an exploit low severity).  A number of packages also include PCRE code
internally, I'll be adding separate bugs for those that contain PCRE and do not
use system PCRE later.

Changelog states:

1. There was no test for integer overflow of quantifier values. A construction
such as {1111111111111111} would give undefined results. What is worse, if
a minimum quantifier for a parenthesized subpattern overflowed and became
negative, the calculation of the memory size went wrong. This  could have led to
memory overwriting.

A minimal diff of the flaw is attached, the full 6.2 to 6.1 diff contains other
fixes that might be worth incorporating and a test for this flaw.


Although PHP in RHEL3 and RHEL4 definately uses the system pcre library, the one
in RHEL2.1 seemed to use the internal version.  This needs confirming and
determining if there is a security context from this flaw.

-- Additional comment from katzj on 2005-08-19 10:55 EST --
pcre in python looks to be a massaging of the system pcre and like it's getting
used. And from the patch, it looks like the vulnerability is there.  Unknown as
to the security sensitivity given that you're only getting there from
python-land where things may get otherwise changed.

-- Additional comment from bressers on 2005-09-14 17:02 EST --
I did some digging on this issue today.  It seems the FC4 python does not
contain pcre, but all the rest do.  As best as I can tell, if you execute a
regular expression using the 're' module, it catches the big integers.  I'm not
sure if that's because it's not using pcre, or if it's just smart.  The overflow
is present if you import and use the 'pcre' module directly.