From 70bc2965604b6b8aaf260049e64c708dddf85334 Mon Sep 17 00:00:00 2001 From: Gary Houston Date: Wed, 25 Feb 2015 13:29:03 +1100 Subject: [PATCH] Bug fix for integer overflow in regcomp for excessively long pattern strings. CERT Vulnerability Note VU#695940. Found by Guido Vranken. --- WHATSNEW | 4 ++++ regcomp.c | 10 +++++++++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/WHATSNEW b/WHATSNEW index 1295343..6eaef31 100644 --- a/WHATSNEW +++ b/WHATSNEW @@ -1,3 +1,7 @@ +New in alpha3.8p1: Bug fix for integer overflow in regcomp for excessively +long pattern strings. CERT Vulnerability Note VU#695940. Found by Guido +Vranken. - Gary Houston, 25 February 2015. + New in alpha3.8: Bug fix for signed/unsigned mixup, found and fixed by the FreeBSD folks. diff --git a/regcomp.c b/regcomp.c index dc48601..12da9b1 100644 --- a/regcomp.c +++ b/regcomp.c @@ -115,7 +115,15 @@ int cflags; (NC-1)*sizeof(cat_t)); if (g == NULL) return(REG_ESPACE); - p->ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */ + { + /* Patched for CERT Vulnerability Note VU#695940, Feb 2015. */ + size_t new_ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */ + if (new_ssize < len || new_ssize > LONG_MAX / sizeof(sop)) { + free((char *) g); + return REG_INVARG; + } + p->ssize = new_ssize; + } p->strip = (sop *)malloc(p->ssize * sizeof(sop)); p->slen = 0; if (p->strip == NULL) {