From: Justin Viiret <justin.viiret@intel.com>
Date: Wed, 28 Oct 2015 22:08:40 +0000 (+1100)
Subject: Check for (and throw on) large min repeat
X-Git-Tag: v4.0.1^2~6
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1afc591c30b8171df82bdcdcc613e280558604d6;p=thirdparty%2Fvectorscan.git

Check for (and throw on) large min repeat

We were only checking for large maximum bounds, which meant that we
would attempt to compile A{N,} where N is huge.
---

diff --git a/src/parser/ComponentRepeat.cpp b/src/parser/ComponentRepeat.cpp
index 325114d8..8cd88372 100644
--- a/src/parser/ComponentRepeat.cpp
+++ b/src/parser/ComponentRepeat.cpp
@@ -51,11 +51,11 @@ using namespace std;
 namespace ue2 {
 
 /** \brief Hard limit on the maximum repeat for bounded repeats. */
-static const u32 MAX_MAX_BOUND = 32767;
+static constexpr u32 MAX_REPEAT = 32767;
 
 /** \brief If expanding a repeat would lead to this many positions being
  * generated, we fail the pattern. */
-static const u32 MAX_POSITIONS_EXPANDED = 500000; // arbitrarily huge
+static constexpr u32 MAX_POSITIONS_EXPANDED = 500000; // arbitrarily huge
 
 /* no edge priorities means that if our subcomponent can be empty, our min
  * extent is effectively zero. */
@@ -67,7 +67,11 @@ ComponentRepeat::ComponentRepeat(unique_ptr<Component> sub_comp_in, u32 min,
     assert(sub_comp);
     assert(max > 0);
     assert(m_min <= m_max);
-    if (m_max < NoLimit && m_max > MAX_MAX_BOUND) {
+
+    if (m_min > MAX_REPEAT) {
+        throw ParseError("Bounded repeat is too large.");
+    }
+    if (m_max != NoLimit && m_max > MAX_REPEAT) {
         throw ParseError("Bounded repeat is too large.");
     }
 }
@@ -119,7 +123,7 @@ void checkPositions(vector<PositionInfo> &v, const GlushkovBuildState &bs) {
 
 void ComponentRepeat::notePositions(GlushkovBuildState &bs) {
     assert(m_max > 0);
-    assert(m_max == NoLimit || m_max < MAX_MAX_BOUND);
+    assert(m_max == NoLimit || m_max < MAX_REPEAT);
 
     /* Note: We can construct smaller subgraphs if we're not maintaining edge
      * priorities. */
diff --git a/unit/hyperscan/bad_patterns.txt b/unit/hyperscan/bad_patterns.txt
index 53a4dcc0..1ad445b3 100644
--- a/unit/hyperscan/bad_patterns.txt
+++ b/unit/hyperscan/bad_patterns.txt
@@ -127,3 +127,4 @@
 127:/^fo?ob{ro|nax_off\Qt=10omnax+8Wnah/ñññññññññññññññññññññññññññ0}l.{1,60}Car*k|npanomnax+8Wnah/8 #Expression is not valid UTF-8.
 128:/(*UTF8)^fo?ob{ro|nax_off\Qt=10omnax+8Wnah/ñññññññññññññññññññññññññññ0}l.{1,60}Car*k|npanomnax+8Wnah/ #Expression is not valid UTF-8.
 129:/bignum \1111111111111111111/ #Number is too big at index 7.
+130:/foo|&{5555555,}/ #Bounded repeat is too large.