From c35b28d627d4804963e084bdd051993064cb25d7 Mon Sep 17 00:00:00 2001 From: JinWang An Date: Thu, 25 Feb 2021 13:25:50 +0900 Subject: [PATCH] [CVE-2009-5155] Diagnose ERE '()|\1' MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Problem reported by Hanno Böck in: http://bugs.gnu.org/21513 * lib/regcomp.c (parse_reg_exp): While parsing alternatives, keep track of the set of previously-completed subexpressions available before the first alternative, and restore this set just before parsing each subsequent alternative. This lets us diagnose the invalid back-reference in the ERE '()|\1'. Change-Id: I6de4f8c79837656f670b5c34a0869619af198abe Signed-off-by: JinWang An --- lib/regcomp.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/lib/regcomp.c b/lib/regcomp.c index f0b2e52..6b7c105 100644 --- a/lib/regcomp.c +++ b/lib/regcomp.c @@ -2187,6 +2187,7 @@ parse_reg_exp (re_string_t *regexp, regex_t *preg, re_token_t *token, { re_dfa_t *dfa = preg->buffer; bin_tree_t *tree, *branch = NULL; + bitset_word_t initial_bkref_map = dfa->completed_bkref_map; tree = parse_branch (regexp, preg, token, syntax, nest, err); if (BE (*err != REG_NOERROR && tree == NULL, 0)) return NULL; @@ -2197,9 +2198,16 @@ parse_reg_exp (re_string_t *regexp, regex_t *preg, re_token_t *token, if (token->type != OP_ALT && token->type != END_OF_RE && (nest == 0 || token->type != OP_CLOSE_SUBEXP)) { + bitset_word_t accumulated_bkref_map = dfa->completed_bkref_map; + dfa->completed_bkref_map = initial_bkref_map; branch = parse_branch (regexp, preg, token, syntax, nest, err); if (BE (*err != REG_NOERROR && branch == NULL, 0)) + { + if (tree != NULL) + postorder (tree, free_tree, NULL); return NULL; + } + dfa->completed_bkref_map |= accumulated_bkref_map; } else branch = NULL; -- 2.7.4