From 82b2af94de0d1989c19ad9020aa5fe1b5f161e82 Mon Sep 17 00:00:00 2001 From: Remi Collet Date: Tue, 27 Aug 2019 06:55:41 +0200 Subject: v6.9.3 --- ...9-13225-problem-in-converting-if-then-els.patch | 72 ---------------------- 1 file changed, 72 deletions(-) delete mode 100644 0010-Fix-CVE-2019-13225-problem-in-converting-if-then-els.patch (limited to '0010-Fix-CVE-2019-13225-problem-in-converting-if-then-els.patch') diff --git a/0010-Fix-CVE-2019-13225-problem-in-converting-if-then-els.patch b/0010-Fix-CVE-2019-13225-problem-in-converting-if-then-els.patch deleted file mode 100644 index a4c140d..0000000 --- a/0010-Fix-CVE-2019-13225-problem-in-converting-if-then-els.patch +++ /dev/null @@ -1,72 +0,0 @@ -From c509265c5f6ae7264f7b8a8aae1cfa5fc59d108c Mon Sep 17 00:00:00 2001 -From: "K.Kosako" -Date: Thu, 27 Jun 2019 14:11:55 +0900 -Subject: [PATCH 10/32] Fix CVE-2019-13225: problem in converting if-then-else - pattern to bytecode. - ---- - src/regcomp.c | 25 +++++++++++++++++-------- - 1 file changed, 17 insertions(+), 8 deletions(-) - -diff --git a/src/regcomp.c b/src/regcomp.c -index c2c04a4..ff3431f 100644 ---- a/src/regcomp.c -+++ b/src/regcomp.c -@@ -1307,8 +1307,9 @@ compile_length_bag_node(BagNode* node, regex_t* reg) - len += tlen; - } - -+ len += SIZE_OP_JUMP + SIZE_OP_ATOMIC_END; -+ - if (IS_NOT_NULL(Else)) { -- len += SIZE_OP_JUMP; - tlen = compile_length_tree(Else, reg); - if (tlen < 0) return tlen; - len += tlen; -@@ -1455,7 +1456,7 @@ compile_bag_node(BagNode* node, regex_t* reg, ScanEnv* env) - - case BAG_IF_ELSE: - { -- int cond_len, then_len, jump_len; -+ int cond_len, then_len, else_len, jump_len; - Node* cond = NODE_BAG_BODY(node); - Node* Then = node->te.Then; - Node* Else = node->te.Else; -@@ -1472,8 +1473,7 @@ compile_bag_node(BagNode* node, regex_t* reg, ScanEnv* env) - else - then_len = 0; - -- jump_len = cond_len + then_len + SIZE_OP_ATOMIC_END; -- if (IS_NOT_NULL(Else)) jump_len += SIZE_OP_JUMP; -+ jump_len = cond_len + then_len + SIZE_OP_ATOMIC_END + SIZE_OP_JUMP; - - r = add_op(reg, OP_PUSH); - if (r != 0) return r; -@@ -1490,11 +1490,20 @@ compile_bag_node(BagNode* node, regex_t* reg, ScanEnv* env) - } - - if (IS_NOT_NULL(Else)) { -- int else_len = compile_length_tree(Else, reg); -- r = add_op(reg, OP_JUMP); -- if (r != 0) return r; -- COP(reg)->jump.addr = else_len + SIZE_INC_OP; -+ else_len = compile_length_tree(Else, reg); -+ if (else_len < 0) return else_len; -+ } -+ else -+ else_len = 0; - -+ r = add_op(reg, OP_JUMP); -+ if (r != 0) return r; -+ COP(reg)->jump.addr = SIZE_OP_ATOMIC_END + else_len + SIZE_INC_OP; -+ -+ r = add_op(reg, OP_ATOMIC_END); -+ if (r != 0) return r; -+ -+ if (IS_NOT_NULL(Else)) { - r = compile_tree(Else, reg, env); - } - } --- -2.21.0 - -- cgit