diff --git a/backport-fix-a-possible-integer-overflow-in-DFA-matching-305.patch b/backport-fix-a-possible-integer-overflow-in-DFA-matching-305.patch new file mode 100644 index 0000000000000000000000000000000000000000..0441a0f022b03ff6d025a7b96204c90977a280e3 --- /dev/null +++ b/backport-fix-a-possible-integer-overflow-in-DFA-matching-305.patch @@ -0,0 +1,24 @@ +From d231944236c6516de2831cbdde3069dab180ae81 Mon Sep 17 00:00:00 2001 +From: pkuzco +Date: Mon, 9 Oct 2023 17:46:42 +0200 +Subject: [PATCH] fix a possible integer overflow in DFA matching (#305) + +--- + src/pcre2_dfa_match.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/pcre2_dfa_match.c b/src/pcre2_dfa_match.c +index 518ac07..13b1ae4 100644 +--- a/src/pcre2_dfa_match.c ++++ b/src/pcre2_dfa_match.c +@@ -428,7 +428,7 @@ overflow. */ + + else + { +- uint32_t newsize = (rws->size >= UINT32_MAX/2)? UINT32_MAX/2 : rws->size * 2; ++ uint32_t newsize = (rws->size >= UINT32_MAX/(sizeof(int)*2))? UINT32_MAX/sizeof(int) : rws->size * 2; + uint32_t newsizeK = newsize/(1024/sizeof(int)); + + if (newsizeK + mb->heap_used > mb->heap_limit) +-- +2.33.0 \ No newline at end of file diff --git a/pcre2.spec b/pcre2.spec index 94a3fbd9772e52d48a0216c7995761dd7c830365..3f79ee9441a1e3f2055e55c07fe87610f20d97b2 100644 --- a/pcre2.spec +++ b/pcre2.spec @@ -1,6 +1,6 @@ Name: pcre2 Version: 10.39 -Release: 9 +Release: 10 Summary: Perl Compatible Regular Expressions License: BSD URL: http://www.pcre.org/ @@ -30,6 +30,7 @@ Patch6019: backport-no-partial-match-if-trailing-data-is-invalid-utf-238.pat Patch6020: backport-Fix-an-invalid-match-of-ascii-word-classes-when-inva.patch Patch6021: backport-fix-wrong-test.patch Patch6022: backport-fix-CVE-2022-41409.patch +Patch6023: backport-fix-a-possible-integer-overflow-in-DFA-matching-305.patch BuildRequires: autoconf libtool automake coreutils gcc make readline-devel Obsoletes: pcre2-utf16 pcre2-utf32 pcre2-tools @@ -146,6 +147,9 @@ make check %{_pkgdocdir}/html/ %changelog +* Thu Dec 14 2023 xujing - 10.39-10 +- DESC:fix a possible integer overflow in DFA matching (#305) + * Mon Jul 31 2023 yangmingtai - 10.39-9 - DESC:fix CVE-2022-41409