From 582128d6b5acdef94752cc4ea4a049497067bb38 Mon Sep 17 00:00:00 2001 From: "Christoph M. Becker" Date: Fri, 16 Aug 2019 14:29:19 +0200 Subject: [PATCH 1/3] Fix #75457: heap-use-after-free in php7.0.25 Backport . (cherry picked from commit 7bf1f9d561826c4a3ed748e55bb756375cdf28b9) --- ext/pcre/pcrelib/pcre_compile.c | 11 ++++++++++- ext/pcre/tests/bug75457.phpt | 10 ++++++++++ 2 files changed, 20 insertions(+), 1 deletion(-) create mode 100644 ext/pcre/tests/bug75457.phpt diff --git a/ext/pcre/pcrelib/pcre_compile.c b/ext/pcre/pcrelib/pcre_compile.c index c9171cbee9..1d37671635 100644 --- a/ext/pcre/pcrelib/pcre_compile.c +++ b/ext/pcre/pcrelib/pcre_compile.c @@ -485,7 +485,7 @@ static const char error_texts[] = "lookbehind assertion is not fixed length\0" "malformed number or name after (?(\0" "conditional group contains more than two branches\0" - "assertion expected after (?(\0" + "assertion expected after (?( or (?(?C)\0" "(?R or (?[+-]digits must be followed by )\0" /* 30 */ "unknown POSIX class name\0" @@ -6734,6 +6734,15 @@ for (;; ptr++) for (i = 3;; i++) if (!IS_DIGIT(ptr[i])) break; if (ptr[i] == CHAR_RIGHT_PARENTHESIS) tempptr += i + 1; + + /* tempptr should now be pointing to the opening parenthesis of the + assertion condition. */ + + if (*tempptr != CHAR_LEFT_PARENTHESIS) + { + *errorcodeptr = ERR28; + goto FAILED; + } } /* For conditions that are assertions, check the syntax, and then exit diff --git a/ext/pcre/tests/bug75457.phpt b/ext/pcre/tests/bug75457.phpt new file mode 100644 index 0000000000..c7ce9ed0f9 --- /dev/null +++ b/ext/pcre/tests/bug75457.phpt @@ -0,0 +1,10 @@ +--TEST-- +Bug #75457 (heap-use-after-free in php7.0.25) +--FILE-- + +--EXPECTF-- +Warning: preg_match(): Compilation failed: assertion expected after (?( or (?(?C) at offset 4 in %sbug75457.php on line %d +bool(false) -- 2.20.1 From b781eb2900cc0d74e385e704711a0002a9ecc8cb Mon Sep 17 00:00:00 2001 From: Remi Collet Date: Wed, 28 Aug 2019 14:34:48 +0200 Subject: [PATCH] relax test, offset may be different on various system lib versions --- ext/pcre/tests/bug75457.phpt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ext/pcre/tests/bug75457.phpt b/ext/pcre/tests/bug75457.phpt index c7ce9ed0f9..571a4bde77 100644 --- a/ext/pcre/tests/bug75457.phpt +++ b/ext/pcre/tests/bug75457.phpt @@ -6,5 +6,5 @@ $pattern = "/(((?(?C)0?=))(?!()0|.(?0)0)())/"; var_dump(preg_match($pattern, "hello")); ?> --EXPECTF-- -Warning: preg_match(): Compilation failed: assertion expected after (?( or (?(?C) at offset 4 in %sbug75457.php on line %d +Warning: preg_match(): Compilation failed: assertion expected after (?( or (?(?C) at offset %d in %sbug75457.php on line %d bool(false) -- 2.20.1