Apply r1513 to our PCRE bundled copy

Fixes CVE-2014-8964.

Upstream diff: http://www.exim.org/viewvc/pcre?view=revision&revision=1513

Change-Id: I59dc1f4c290e29ab5f22ed68eaeba702f4232e0e
Reviewed-by: Oswald Buddenhagen <oswald.buddenhagen@theqtcompany.com>
Reviewed-by: Lars Knoll <lars.knoll@digia.com>
Reviewed-by: Richard J. Moore <rich@kde.org>

diff --git a/src/3rdparty/pcre/patches/pcre-r1513.patch b/src/3rdparty/pcre/patches/pcre-r1513.patch
new file mode 100644 (file)
index 0000000..d84aa0c
--- /dev/null
+++ b/src/3rdparty/pcre/patches/pcre-r1513.patch
@@ -0,0 +1,18 @@
+Index: pcre_exec.c
+===================================================================
+--- pcre_exec.c        (revisione 1512)
++++ pcre_exec.c        (revisione 1513)
+@@ -1404,8 +1404,11 @@
+         condition = TRUE;
+ 
+         /* Advance ecode past the assertion to the start of the first branch,
+-        but adjust it so that the general choosing code below works. */
+-
++        but adjust it so that the general choosing code below works. If the 
++        assertion has a quantifier that allows zero repeats we must skip over 
++        the BRAZERO. This is a lunatic thing to do, but somebody did! */
++        
++        if (*ecode == OP_BRAZERO) ecode++; 
+         ecode += GET(ecode, 1);
+         while (*ecode == OP_ALT) ecode += GET(ecode, 1);
+         ecode += 1 + LINK_SIZE - PRIV(OP_lengths)[condcode];

diff --git a/src/3rdparty/pcre/pcre_exec.c b/src/3rdparty/pcre/pcre_exec.c
index b0101da351b80f69c695c723dfce8b025f26c6ba..7755aaf13a9dc1baf5341bdd9c7fc331ae0de276 100644 (file)
--- a/src/3rdparty/pcre/pcre_exec.c
+++ b/src/3rdparty/pcre/pcre_exec.c
@@ -1394,8 +1394,11 @@ for (;;)
         condition = TRUE;
 
         /* Advance ecode past the assertion to the start of the first branch,
-        but adjust it so that the general choosing code below works. */
-
+        but adjust it so that the general choosing code below works. If the 
+        assertion has a quantifier that allows zero repeats we must skip over 
+        the BRAZERO. This is a lunatic thing to do, but somebody did! */
+        
+        if (*ecode == OP_BRAZERO) ecode++; 
         ecode += GET(ecode, 1);
         while (*ecode == OP_ALT) ecode += GET(ecode, 1);
         ecode += 1 + LINK_SIZE - PRIV(OP_lengths)[condcode];