From 800f832201267bcbf6a7e9b4b9dbc69f9029dcc0 Mon Sep 17 00:00:00 2001 From: Giuseppe D'Angelo Date: Fri, 21 Nov 2014 15:30:01 +0100 Subject: Apply r1513 to our PCRE bundled copy Fixes CVE-2014-8964. Upstream diff: http://www.exim.org/viewvc/pcre?view=revision&revision=1513 Change-Id: I59dc1f4c290e29ab5f22ed68eaeba702f4232e0e Reviewed-by: Oswald Buddenhagen Reviewed-by: Lars Knoll Reviewed-by: Richard J. Moore --- src/3rdparty/pcre/patches/pcre-r1513.patch | 18 ++++++++++++++++++ src/3rdparty/pcre/pcre_exec.c | 7 +++++-- 2 files changed, 23 insertions(+), 2 deletions(-) create mode 100644 src/3rdparty/pcre/patches/pcre-r1513.patch (limited to 'src/3rdparty') diff --git a/src/3rdparty/pcre/patches/pcre-r1513.patch b/src/3rdparty/pcre/patches/pcre-r1513.patch new file mode 100644 index 0000000000..d84aa0cc61 --- /dev/null +++ b/src/3rdparty/pcre/patches/pcre-r1513.patch @@ -0,0 +1,18 @@ +Index: pcre_exec.c +=================================================================== +--- pcre_exec.c (revisione 1512) ++++ pcre_exec.c (revisione 1513) +@@ -1404,8 +1404,11 @@ + condition = TRUE; + + /* Advance ecode past the assertion to the start of the first branch, +- but adjust it so that the general choosing code below works. */ +- ++ but adjust it so that the general choosing code below works. If the ++ assertion has a quantifier that allows zero repeats we must skip over ++ the BRAZERO. This is a lunatic thing to do, but somebody did! */ ++ ++ if (*ecode == OP_BRAZERO) ecode++; + ecode += GET(ecode, 1); + while (*ecode == OP_ALT) ecode += GET(ecode, 1); + ecode += 1 + LINK_SIZE - PRIV(OP_lengths)[condcode]; diff --git a/src/3rdparty/pcre/pcre_exec.c b/src/3rdparty/pcre/pcre_exec.c index b0101da351..7755aaf13a 100644 --- a/src/3rdparty/pcre/pcre_exec.c +++ b/src/3rdparty/pcre/pcre_exec.c @@ -1394,8 +1394,11 @@ for (;;) condition = TRUE; /* Advance ecode past the assertion to the start of the first branch, - but adjust it so that the general choosing code below works. */ - + but adjust it so that the general choosing code below works. If the + assertion has a quantifier that allows zero repeats we must skip over + the BRAZERO. This is a lunatic thing to do, but somebody did! */ + + if (*ecode == OP_BRAZERO) ecode++; ecode += GET(ecode, 1); while (*ecode == OP_ALT) ecode += GET(ecode, 1); ecode += 1 + LINK_SIZE - PRIV(OP_lengths)[condcode]; -- cgit v1.2.3