1
0
mirror of https://git.FreeBSD.org/ports.git synced 2024-11-27 00:57:50 +00:00

devel/pcre: Add patch to resolve heap overflow vulnerability

Obtained from:	http://vcs.pcre.org/pcre?view=revision&revision=1594
Security:	6900e6f1-4a79-11e5-9ad8-14dae9d210b8
This commit is contained in:
Mark Felder 2015-08-24 16:25:22 +00:00
parent c861a52533
commit b5699007b2
Notes: svn2git 2021-03-31 03:12:20 +00:00
svn path=/head/; revision=395178
2 changed files with 21 additions and 1 deletions

View File

@ -3,7 +3,7 @@
PORTNAME= pcre
PORTVERSION= 8.37
PORTREVISION= 3
PORTREVISION= 4
CATEGORIES= devel
MASTER_SITES= SF/${PORTNAME}/${PORTNAME}/${PORTVERSION} \
ftp://ftp.csx.cam.ac.uk/pub/software/programming/${PORTNAME}/ \

View File

@ -0,0 +1,20 @@
--- pcre_compile.c 2015/08/14 09:34:32 1593
+++ pcre_compile.c 2015/08/21 16:08:33 1594
@@ -7238,7 +7238,7 @@
encountered. In that case, we allow yet more memory, just in case.
(Again, this is fixed "properly" in PCRE2. */
- if (cd->dupgroups) *lengthptr += 2 + 2*LINK_SIZE;
+ if (cd->dupgroups) *lengthptr += 4 + 4*LINK_SIZE;
/* Otherwise, check for recursion here. The name table does not exist
in the first pass; instead we must scan the list of names encountered
@@ -9474,7 +9474,7 @@
"const" attribute if the cast (pcre_uchar *)codestart is used directly in the
function call. */
-if ((options & PCRE_NO_AUTO_POSSESS) == 0)
+if (errorcode == 0 && (options & PCRE_NO_AUTO_POSSESS) == 0)
{
pcre_uchar *temp = (pcre_uchar *)codestart;
auto_possessify(temp, utf, cd);