RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-26 04:27:44 +00:00
Code Issues Activity Actions

LibRegex: Limit the number of nested capture groups allowed in BRE

Browse source 
Found by OSS-Fuzz: https://oss-fuzz.com/testcase?key=4869334212673536
This commit is contained in:
Ali Mohammad Pur 2021-08-30 23:24:46 +04:30 • committed by Andreas Kling
parent c171aa40a8
commit 05c65f9b5d
2 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
Userland/Libraries/LibRegex/RegexParser.cpp
View file

@ -12,6 +12,7 @@
#include <AK/String.h> #include <AK/String.h>
#include <AK/StringBuilder.h> #include <AK/StringBuilder.h>
#include <AK/StringUtils.h> #include <AK/StringUtils.h>
#include <AK/TemporaryChange.h>
#include <AK/Utf16View.h> #include <AK/Utf16View.h>
#include <LibUnicode/CharacterTypes.h> #include <LibUnicode/CharacterTypes.h>
@ -460,6 +461,11 @@ bool PosixBasicParser::parse_nonduplicating_re(ByteCode& bytecode, size_t& match
{ {
// nondupl_RE : one_char_or_coll_elem_RE | Back_open_paren RE_expression Back_close_paren | BACKREF // nondupl_RE : one_char_or_coll_elem_RE | Back_open_paren RE_expression Back_close_paren | BACKREF
if (try_skip("\\(")) { if (try_skip("\\(")) {
TemporaryChange change { m_current_capture_group_depth, m_current_capture_group_depth + 1 };
// Max number of addressable capture groups is 10, let's just be lenient
// and accept 20; anything past that is probably a silly pattern anyway.
if (m_current_capture_group_depth > 20)
return set_error(Error::InvalidPattern);
ByteCode capture_bytecode; ByteCode capture_bytecode;
size_t capture_length_minimum = 0; size_t capture_length_minimum = 0;
auto capture_group_index = ++m_parser_state.capture_groups_count; auto capture_group_index = ++m_parser_state.capture_groups_count;

1
Userland/Libraries/LibRegex/RegexParser.h
View file

@ -166,6 +166,7 @@ private:
constexpr static size_t number_of_addressable_capture_groups = 9; constexpr static size_t number_of_addressable_capture_groups = 9;
size_t m_capture_group_minimum_lengths[number_of_addressable_capture_groups] { 0 }; size_t m_capture_group_minimum_lengths[number_of_addressable_capture_groups] { 0 };
bool m_capture_group_seen[number_of_addressable_capture_groups] { false }; bool m_capture_group_seen[number_of_addressable_capture_groups] { false };
size_t m_current_capture_group_depth { 0 };
}; };
class PosixExtendedParser final : public AbstractPosixParser { class PosixExtendedParser final : public AbstractPosixParser {