RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-25 13:47:45 +00:00
Code Issues Activity Actions

LibRegex: Disallow excessively large repetition counts in {B,E}RE

Browse source
This commit is contained in:
Ali Mohammad Pur 2021-07-13 02:13:17 +04:30 • committed by Gunnar Beutner
parent f9fed0b167
commit 189922f442
1 changed files with 12 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

13
Userland/Libraries/LibRegex/RegexParser.cpp
View file

@ -13,6 +13,8 @@
namespace regex { namespace regex {
static constexpr size_t s_maximum_repetition_count = 1024 * 1024;
ALWAYS_INLINE bool Parser::set_error(Error error) ALWAYS_INLINE bool Parser::set_error(Error error)
{ {
if (m_parser_state.error == Error::NoError) { if (m_parser_state.error == Error::NoError) {
@ -395,6 +397,12 @@ bool PosixBasicParser::parse_simple_re(ByteCode& bytecode, size_t& match_length_
if (!try_skip("\\}")) if (!try_skip("\\}"))
return set_error(Error::MismatchingBrace); return set_error(Error::MismatchingBrace);
if (max_limit.value_or(min_limit) < min_limit)
return set_error(Error::InvalidBraceContent);
if (min_limit > s_maximum_repetition_count || (max_limit.has_value() && *max_limit > s_maximum_repetition_count))
return set_error(Error::InvalidBraceContent);
ByteCode::transform_bytecode_repetition_min_max(simple_re_bytecode, min_limit, max_limit, true); ByteCode::transform_bytecode_repetition_min_max(simple_re_bytecode, min_limit, max_limit, true);
match_length_minimum += re_match_length_minimum * min_limit; match_length_minimum += re_match_length_minimum * min_limit;
} else { } else {
@ -533,6 +541,9 @@ ALWAYS_INLINE bool PosixExtendedParser::parse_repetition_symbol(ByteCode& byteco
auto minimum = maybe_minimum.value(); auto minimum = maybe_minimum.value();
match_length_minimum *= minimum; match_length_minimum *= minimum;
if (minimum > s_maximum_repetition_count)
return set_error(Error::InvalidBraceContent);
if (match(TokenType::Comma)) { if (match(TokenType::Comma)) {
consume(); consume();
} else { } else {
@ -551,7 +562,7 @@ ALWAYS_INLINE bool PosixExtendedParser::parse_repetition_symbol(ByteCode& byteco
} }
if (!number_builder.is_empty()) { if (!number_builder.is_empty()) {
auto value = number_builder.build().to_uint(); auto value = number_builder.build().to_uint();
if (!value.has_value() || minimum > value.value()) if (!value.has_value() || minimum > value.value() || *value > s_maximum_repetition_count)
return set_error(Error::InvalidBraceContent); return set_error(Error::InvalidBraceContent);
maybe_maximum = value.value(); maybe_maximum = value.value();