From f5c1d00a9ceb61acfe038dcf2ec0236c2939328c Mon Sep 17 00:00:00 2001 From: Roy Li Date: Mon, 1 Jun 2015 15:31:48 +0800 Subject: [PATCH] From 70bc2965604b6b8aaf260049e64c708dddf85334 Mon Sep 17 00:00:00 2001 From: Gary Houston Date: Wed, 25 Feb 2015 13:29:03 +1100 Subject: [PATCH] Bug fix for integer overflow in regcomp for excessively long pattern strings. CERT Vulnerability Note VU#695940. Found by Guido Vranken. Upsteam-Status: Backport https://bugzilla.suse.com/attachment.cgi?id=627001 Signed-off-by: Roy Li --- regex/regcomp.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/regex/regcomp.c b/regex/regcomp.c index abc1817..31e57c1 100644 --- a/regex/regcomp.c +++ b/regex/regcomp.c @@ -138,7 +138,16 @@ struct cclass cclasses[CCLASS_LAST+1]= { (NC-1)*sizeof(cat_t)); if (g == NULL) return(REG_ESPACE); - p->ssize = (long) (len/(size_t)2*(size_t)3 + (size_t)1); /* ugh */ + { + /* Patched for CERT Vulnerability Note VU#695940, Feb 2015. */ + size_t new_ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */ + if (new_ssize < len || new_ssize > LONG_MAX / sizeof(sop)) { + free((char *) g); + return REG_INVARG; + } + p->ssize = new_ssize; + } + p->strip = (sop *)malloc(p->ssize * sizeof(sop)); p->slen = 0; if (p->strip == NULL) { -- 1.9.1