src/patches/pcre-8.37-Fix-named-forward-reference-to-duplicate-group-numbe.patch

   1 From 83ed574998fe7b844b98ab7cd56291068feb9e31 Mon Sep 17 00:00:00 2001
   2 From: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
   3 Date: Sat, 16 May 2015 11:05:40 +0000
   4 Subject: [PATCH] Fix named forward reference to duplicate group number
   5  overflow bug.
   6 MIME-Version: 1.0
   7 Content-Type: text/plain; charset=UTF-8
   8 Content-Transfer-Encoding: 8bit
   9
  10 Port to 8.37:
  11
  12 commit 2fa78aa4e42bcebf2d616c4ee89c012f29dc3447
  13 Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
  14 Date:   Sat May 16 11:05:40 2015 +0000
  15
  16     Fix named forward reference to duplicate group number overflow bug.
  17
  18     git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1559 2f5784b3-3f2a-0410-8824-cb99058d5e15
  19
  20 Signed-off-by: Petr Písař <ppisar@redhat.com>
  21 ---
  22  pcre_compile.c       | 24 ++++++++++++++++--------
  23  testdata/testinput1  |  3 +++
  24  testdata/testoutput1 |  5 +++++
  25  3 files changed, 24 insertions(+), 8 deletions(-)
  26
  27 diff --git a/pcre_compile.c b/pcre_compile.c
  28 index b66b1f6..8b4aaef 100644
  29 --- a/pcre_compile.c
  30 +++ b/pcre_compile.c
  31 @@ -7183,15 +7183,15 @@ for (;; ptr++)
  32                open_capitem *oc;
  33                recno = ng->number;
  34                if (is_recurse) break;
  35 -              for (oc = cd->open_caps; oc != NULL; oc = oc->next)
  36 -                {
  37 -                if (oc->number == recno)
  38 -                  {
  39 -                  oc->flag = TRUE;
  40 +              for (oc = cd->open_caps; oc != NULL; oc = oc->next)
  41 +                {
  42 +                if (oc->number == recno)
  43 +                  {
  44 +                  oc->flag = TRUE;
  45                    break;
  46 -                  }
  47 -                }
  48 -              }
  49 +                  }
  50 +                }
  51 +              }
  52              }
  53
  54            /* Count named back references. */
  55 @@ -7203,6 +7203,14 @@ for (;; ptr++)
  56            16-bit data item. */
  57
  58            *lengthptr += IMM2_SIZE;
  59 +
  60 +          /* If this is a forward reference and we are within a (?|...) group,
  61 +          the reference may end up as the number of a group which we are
  62 +          currently inside, that is, it could be a recursive reference. In the
  63 +          real compile this will be picked up and the reference wrapped with
  64 +          OP_ONCE to make it atomic, so we must space in case this occurs. */
  65 +
  66 +          if (recno == 0) *lengthptr += 2 + 2*LINK_SIZE;
  67            }
  68
  69          /* In the real compile, search the name table. We check the name
  70 diff --git a/testdata/testinput1 b/testdata/testinput1
  71 index 73c2f4d..8379ce0 100644
  72 --- a/testdata/testinput1
  73 +++ b/testdata/testinput1
  74 @@ -5730,4 +5730,7 @@ AbcdCBefgBhiBqz
  75  "(?1)(?#?'){8}(a)"
  76      baaaaaaaaac
  77
  78 +"(?|(\k'Pm')|(?'Pm'))"
  79 +    abcd
  80 +
  81  /-- End of testinput1 --/
  82 diff --git a/testdata/testoutput1 b/testdata/testoutput1
  83 index 0a53fd0..e852ab9 100644
  84 --- a/testdata/testoutput1
  85 +++ b/testdata/testoutput1
  86 @@ -9429,4 +9429,9 @@ No match
  87   0: aaaaaaaaa
  88   1: a
  89
  90 +"(?|(\k'Pm')|(?'Pm'))"
  91 +    abcd
  92 + 0:
  93 + 1:
  94 +
  95  /-- End of testinput1 --/
  96 --
  97 2.4.3
  98