From f16262e54453d6dc483db3deda5c2674d8c1d52a Mon Sep 17 00:00:00 2001 From: TSUYUSATO Kitsune Date: Mon, 28 Jul 2025 16:18:11 +0900 Subject: Port a Oniguruma patch: Integer overflow in backward_search_range() and onig_search_gpos() https://github.com/kkos/oniguruma/commit/bfc36d3d8139b8be4d3df630d625c58687b0c7d4 Co-Authored-By: K.Kosako --- regexec.c | 29 +++++++++++++++++++++++------ 1 file changed, 23 insertions(+), 6 deletions(-) diff --git a/regexec.c b/regexec.c index 4a67d428ed..b8178637eb 100644 --- a/regexec.c +++ b/regexec.c @@ -4828,7 +4828,6 @@ backward_search_range(regex_t* reg, const UChar* str, const UChar* end, return 0; } - range += reg->dmin; p = s; retry: @@ -4906,10 +4905,22 @@ backward_search_range(regex_t* reg, const UChar* str, const UChar* end, } } - /* no needs to adjust *high, *high is used as range check only */ if (reg->dmax != ONIG_INFINITE_DISTANCE) { - *low = p - reg->dmax; - *high = p - reg->dmin; + if (p - str < reg->dmax) + *low = (UChar* )str; + else + *low = p - reg->dmax; + + if (reg->dmin != 0) { + if (p - str < reg->dmin) + *high = (UChar* )str; + else + *high = p - reg->dmin; + } + else { + *high = p; + } + *high = onigenc_get_right_adjust_char_head(reg->enc, adjrange, *high, end); } @@ -5215,18 +5226,24 @@ onig_search_gpos(regex_t* reg, const UChar* str, const UChar* end, else { /* backward search */ if (reg->optimize != ONIG_OPTIMIZE_NONE) { UChar *low, *high, *adjrange, *sch_start; + const UChar *min_range; if (range < end) adjrange = ONIGENC_LEFT_ADJUST_CHAR_HEAD(reg->enc, str, range, end); else adjrange = (UChar* )end; + if (end - range > reg->dmin) + min_range = range + reg->dmin; + else + min_range = end; + if (reg->dmax != ONIG_INFINITE_DISTANCE && (end - range) >= reg->threshold_len) { do { sch_start = s + reg->dmax; if (sch_start > end) sch_start = (UChar* )end; - if (backward_search_range(reg, str, end, sch_start, range, adjrange, + if (backward_search_range(reg, str, end, sch_start, min_range, adjrange, &low, &high) <= 0) goto mismatch; @@ -5256,7 +5273,7 @@ onig_search_gpos(regex_t* reg, const UChar* str, const UChar* end, start, sch_start, end); } } - if (backward_search_range(reg, str, end, sch_start, range, adjrange, + if (backward_search_range(reg, str, end, sch_start, min_range, adjrange, &low, &high) <= 0) goto mismatch; } } -- cgit v1.2.3