It was found that PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references to a group whose number is the same as the current group.
Created pcre tracking bugs for this issue: Affects: fedora-all [bug 1287630]
Created glib2 tracking bugs for this issue: Affects: fedora-all [bug 1287632]
Created mingw-pcre tracking bugs for this issue: Affects: fedora-all [bug 1287631] Affects: epel-7 [bug 1287634]
Correspond to item 5 in http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup
Fixed in upstream with: commit 2fa78aa4e42bcebf2d616c4ee89c012f29dc3447 Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15> Date: Sat May 16 11:05:40 2015 +0000 Fix named forward reference to duplicate group number overflow bug. git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1559 2f5784b3-3f2a-0410-8824- cb99058d5e15
This is a duplicate of bug #1250943.
(In reply to Petr Pisar from comment #5) > commit 2fa78aa4e42bcebf2d616c4ee89c012f29dc3447 > Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15> > Date: Sat May 16 11:05:40 2015 +0000 > > Fix named forward reference to duplicate group number overflow bug. Upstream commit link: http://vcs.pcre.org/pcre?view=revision&revision=1559
(In reply to Petr Pisar from comment #6) > This is a duplicate of bug #1250943. Why do you believe those are duplicates? I see the issue in bug 1250943 is associated with upstream rev1585. The pattern used in test for rev1559 (i.e. this issue) triggers valgrind errors down to version 8.01.
(In reply to Tomas Hoger from comment #8) > (In reply to Petr Pisar from comment #6) > > This is a duplicate of bug #1250943. > > Why do you believe those are duplicates? I see the issue in bug 1250943 is > associated with upstream rev1585. The pattern used in test for rev1559 > (i.e. this issue) triggers valgrind errors down to version 8.01. I mistaken bug numbers probably. This bug #1287629 seems to be duplicate of bug #1250943.
(In reply to Petr Pisar from comment #9) > I mistaken bug numbers probably. > > This bug #1287629 seems to be duplicate of bug #1250943. The above refers to the same bugs as comment 6.
(In reply to Tomas Hoger from comment #10) > (In reply to Petr Pisar from comment #9) > > I mistaken bug numbers probably. > > > > This bug #1287629 seems to be duplicate of bug #1250943. > > The above refers to the same bugs as comment 6. I'm sorry. I got lost. I cannot find any duplicate in the Bugzilla now.
My testing shows this issue was introduced in version 8.01 via the following change: http://vcs.pcre.org/pcre?view=revision&revision=488 https://bugs.exim.org/show_bug.cgi?id=947
It's difficult to port the fix to 8.32 version. The reason is upstream refactored the named/numbered group handling (from a static to dynamic look-up table) in "Refactor the code for creating the name/number table" commit that is newer than 8.32 version. I have a patch set of tree patches that together fixes thi bug while passing all tests, but I don't have good feeling of it. I will attach them here. Is really necessary to address this bug?
Created attachment 1152231 [details] Fix-duplicate-names-memory-calculation-error (1/3)
Created attachment 1152232 [details] Fix-named-forward-reference-to-duplicate-group-numbe.patch (2/3)
Created attachment 1152233 [details] Fix-buffer-overflow-for-named-references-in-situatio.patch
(In reply to Petr Pisar from comment #15) > Is really necessary to address this bug? Yes, this is something we should fix, as it's memory corruption issue.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2016:1025 https://rhn.redhat.com/errata/RHSA-2016-1025.html
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Via RHSA-2016:1132 https://access.redhat.com/errata/RHSA-2016:1132
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html