[webkit-changes] cvs commit: JavaScriptCore/pcre pcre.c

[Geoffrey]

ggaren      05/11/04 15:26:49

  Modified:    .        Tag: Ti-2005-009-branch ChangeLog
               pcre     Tag: Ti-2005-009-branch pcre.c
  Log:
          Reviewed by darin.
  
          - Fixed <rdar://problem/4317701> *SecUpd: Tiger* PCRE heap overflow
            in Safari JavaScriptCore
  
          * pcre/pcre.c:
          (read_repeat_counts): We now return an error for negative repeat counts
          in regular expressions. This matches Firefox exactly, and Win IE by
          effect (Win IE doesn't return an error, but it does refuse to match
          anything).
  
  Revision  Changes    Path
  No                   revision
  
  
  No                   revision
  
  
  1.677.6.34.2.14.2.1 +13 -0     JavaScriptCore/ChangeLog
  
  Index: ChangeLog
  ===================================================================
  RCS file: /cvs/root/JavaScriptCore/ChangeLog,v
  retrieving revision 1.677.6.34.2.14
  retrieving revision 1.677.6.34.2.14.2.1
  diff -u -r1.677.6.34.2.14 -r1.677.6.34.2.14.2.1
  --- ChangeLog	4 Oct 2005 04:01:35 -0000	1.677.6.34.2.14
  +++ ChangeLog	4 Nov 2005 23:26:44 -0000	1.677.6.34.2.14.2.1
  @@ -1,3 +1,16 @@
  +2005-11-04  Geoffrey Garen  <ggaren at apple.com>
  +
  +        Reviewed by darin.
  +
  +        - Fixed <rdar://problem/4317701> *SecUpd: Tiger* PCRE heap overflow 
  +          in Safari JavaScriptCore
  +
  +        * pcre/pcre.c:
  +        (read_repeat_counts): We now return an error for negative repeat counts
  +        in regular expressions. This matches Firefox exactly, and Win IE by 
  +        effect (Win IE doesn't return an error, but it does refuse to match 
  +        anything).
  +
   === JavaScriptCore-416.13 ===
   
   2005-10-03  Geoffrey Garen  <ggaren at apple.com>
  
  
  
  No                   revision
  
  
  No                   revision
  
  
  1.3.12.2.4.1 +15 -9     JavaScriptCore/pcre/Attic/pcre.c
  
  Index: pcre.c
  ===================================================================
  RCS file: /cvs/root/JavaScriptCore/pcre/Attic/pcre.c,v
  retrieving revision 1.3.12.2
  retrieving revision 1.3.12.2.4.1
  diff -u -r1.3.12.2 -r1.3.12.2.4.1
  --- pcre.c	9 Aug 2005 01:14:03 -0000	1.3.12.2
  +++ pcre.c	4 Nov 2005 23:26:49 -0000	1.3.12.2.4.1
  @@ -771,6 +771,11 @@
   int max = -1;
   
   while ((cd->ctypes[*p] & ctype_digit) != 0) min = min * 10 + *p++ - '0';
  +if (min < 0 || min > 65535)
  +  {
  +  *errorptr = ERR5;
  +  return p;
  +  }
   
   if (*p == '}') max = min; else
     {
  @@ -778,6 +783,11 @@
       {
       max = 0;
       while((cd->ctypes[*p] & ctype_digit) != 0) max = max * 10 + *p++ - '0';
  +    if (max < 0 || max > 65535)
  +      {
  +      *errorptr = ERR5;
  +      return p;
  +      }
       if (max < min)
         {
         *errorptr = ERR4;
  @@ -786,16 +796,12 @@
       }
     }
   
  -/* Do paranoid checks, then fill in the required variables, and pass back the
  -pointer to the terminating '}'. */
  +/* fill in the required variables, and pass back the pointer to the 
  +terminating '}'. */
  +
  +*minp = min;
  +*maxp = max;
   
  -if (min > 65535 || max > 65535)
  -  *errorptr = ERR5;
  -else
  -  {
  -  *minp = min;
  -  *maxp = max;
  -  }
   return p;
   }