Merge bug fixes from main Trunk: these fix security issues reported by Will Drewry.

[SVN r42746]
This commit is contained in:
John Maddock
2008-01-14 09:53:42 +00:00
parent 79d7e84f26
commit 069e845239
2 changed files with 22 additions and 0 deletions

View File

@ -784,6 +784,7 @@ bool basic_regex_parser<charT, traits>::parse_repeat(std::size_t low, std::size_
case syntax_element_restart_continue:
case syntax_element_jump:
case syntax_element_startmark:
case syntax_element_backstep:
// can't legally repeat any of the above:
fail(regex_constants::error_badrepeat, m_position - m_base);
return false;
@ -1869,6 +1870,7 @@ bool basic_regex_parser<charT, traits>::parse_perl_extension()
if(markid == -4)
{
re_syntax_base* b = this->getaddress(expected_alt_point);
// Make sure we have exactly one alternative following this state:
if(b->type != syntax_element_alt)
{
re_alt* alt = static_cast<re_alt*>(this->insert_state(expected_alt_point, syntax_element_alt, sizeof(re_alt)));
@ -1879,6 +1881,15 @@ bool basic_regex_parser<charT, traits>::parse_perl_extension()
fail(regex_constants::error_bad_pattern, m_position - m_base);
return false;
}
// check for invalid repetition of next state:
b = this->getaddress(expected_alt_point);
b = this->getaddress(static_cast<re_alt*>(b)->next.i, b);
if((b->type != syntax_element_assert_backref)
&& (b->type != syntax_element_startmark))
{
fail(regex_constants::error_badrepeat, m_position - m_base);
return false;
}
}
//
// append closing parenthesis state: