summaryrefslogtreecommitdiff
path: root/debian/patches/0110-CVE-2019-13225.patch
diff options
context:
space:
mode:
authorJörg Frings-Fürst <debian@jff.email>2019-07-12 10:25:50 +0200
committerJörg Frings-Fürst <debian@jff.email>2019-07-12 10:25:50 +0200
commit2c7655105475ad81ad07eedc9dded1924afb154f (patch)
treee9867d777e3ede7f5ffa0484b5f0b202034fad38 /debian/patches/0110-CVE-2019-13225.patch
parent509a5b00debac36f95c54041e143940e21fc1c40 (diff)
Fix CVE-2019-1322[4-5]
Diffstat (limited to 'debian/patches/0110-CVE-2019-13225.patch')
-rw-r--r--debian/patches/0110-CVE-2019-13225.patch66
1 files changed, 66 insertions, 0 deletions
diff --git a/debian/patches/0110-CVE-2019-13225.patch b/debian/patches/0110-CVE-2019-13225.patch
new file mode 100644
index 0000000..be9e152
--- /dev/null
+++ b/debian/patches/0110-CVE-2019-13225.patch
@@ -0,0 +1,66 @@
+Description: CVE-2019-13225
+ problem in converting if-then-else pattern to bytecode.
+Origin: upstream, https://github.com/kkos/oniguruma/commit/c509265c5f6ae7264f7b8a8aae1cfa5fc59d108c
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931878
+Last-Update: 2019-07-12
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+Index: trunk/src/regcomp.c
+===================================================================
+--- trunk.orig/src/regcomp.c
++++ trunk/src/regcomp.c
+@@ -1307,8 +1307,9 @@ compile_length_bag_node(BagNode* node, r
+ len += tlen;
+ }
+
++ len += SIZE_OP_JUMP + SIZE_OP_ATOMIC_END;
++
+ if (IS_NOT_NULL(Else)) {
+- len += SIZE_OP_JUMP;
+ tlen = compile_length_tree(Else, reg);
+ if (tlen < 0) return tlen;
+ len += tlen;
+@@ -1455,7 +1456,7 @@ compile_bag_node(BagNode* node, regex_t*
+
+ case BAG_IF_ELSE:
+ {
+- int cond_len, then_len, jump_len;
++ int cond_len, then_len, else_len, jump_len;
+ Node* cond = NODE_BAG_BODY(node);
+ Node* Then = node->te.Then;
+ Node* Else = node->te.Else;
+@@ -1472,8 +1473,7 @@ compile_bag_node(BagNode* node, regex_t*
+ else
+ then_len = 0;
+
+- jump_len = cond_len + then_len + SIZE_OP_ATOMIC_END;
+- if (IS_NOT_NULL(Else)) jump_len += SIZE_OP_JUMP;
++ jump_len = cond_len + then_len + SIZE_OP_ATOMIC_END + SIZE_OP_JUMP;
+
+ r = add_op(reg, OP_PUSH);
+ if (r != 0) return r;
+@@ -1490,11 +1490,20 @@ compile_bag_node(BagNode* node, regex_t*
+ }
+
+ if (IS_NOT_NULL(Else)) {
+- int else_len = compile_length_tree(Else, reg);
+- r = add_op(reg, OP_JUMP);
+- if (r != 0) return r;
+- COP(reg)->jump.addr = else_len + SIZE_INC_OP;
++ else_len = compile_length_tree(Else, reg);
++ if (else_len < 0) return else_len;
++ }
++ else
++ else_len = 0;
+
++ r = add_op(reg, OP_JUMP);
++ if (r != 0) return r;
++ COP(reg)->jump.addr = SIZE_OP_ATOMIC_END + else_len + SIZE_INC_OP;
++
++ r = add_op(reg, OP_ATOMIC_END);
++ if (r != 0) return r;
++
++ if (IS_NOT_NULL(Else)) {
+ r = compile_tree(Else, reg, env);
+ }
+ }