| Description: CVE-2014-8964, heap buffer overflow |
| Heap buffer overflow if an assertion with a zero minimum repeat is used as |
| the condition in a conditional group. |
| Origin: upstream http://bugs.exim.org/show_bug.cgi?id=1546 |
| Bug: http://bugs.exim.org/show_bug.cgi?id=1546 |
| Applied-Upstream: Yes, after 8.36 |
| |
| Signed-off-by: Baruch Siach <baruch@tkos.co.il> |
| --- |
| This patch header follows DEP-3: http://dep.debian.net/deps/dep3/ |
| --- a/pcre_exec.c |
| +++ b/pcre_exec.c |
| @@ -1404,8 +1404,11 @@ |
| condition = TRUE; |
| |
| /* Advance ecode past the assertion to the start of the first branch, |
| - but adjust it so that the general choosing code below works. */ |
| + but adjust it so that the general choosing code below works. If the |
| + assertion has a quantifier that allows zero repeats we must skip over |
| + the BRAZERO. This is a lunatic thing to do, but somebody did! */ |
| |
| + if (*ecode == OP_BRAZERO) ecode++; |
| ecode += GET(ecode, 1); |
| while (*ecode == OP_ALT) ecode += GET(ecode, 1); |
| ecode += 1 + LINK_SIZE - PRIV(OP_lengths)[condcode]; |
