From ae7819ddb1a105004a8d2d6e0af56cba65968b65 Mon Sep 17 00:00:00 2001 From: jzmaddock Date: Wed, 6 Apr 2022 17:52:09 +0100 Subject: [PATCH] Fix for numeric overflow found during fuzzing. --- include/boost/regex/v5/basic_regex_creator.hpp | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/boost/regex/v5/basic_regex_creator.hpp b/include/boost/regex/v5/basic_regex_creator.hpp index 82306d36..bb76c7c1 100644 --- a/include/boost/regex/v5/basic_regex_creator.hpp +++ b/include/boost/regex/v5/basic_regex_creator.hpp @@ -1019,6 +1019,8 @@ int basic_regex_creator::calculate_backstep(re_syntax_base* state { if(rep->max != rep->min) return -1; + if (static_cast((std::numeric_limits::max)() - result) < rep->min) + return -1; // protection against overflow, we can't calculate a backstep in this case and the expression is probably ill-formed. result += static_cast(rep->min); state = rep->alt.p; continue;