Skip to content

Commit 36673bd

Browse files
committed
Use assertion to ensure erroroffset return from pcre2_compile is valid
When testing the new pattern rewriting phase for regex compilation using a fuzzer, I had a scary experience. Due to a bug in my pattern rewriting code, pcre2_compile() could return a totally invalid erroroffset. If a library user tried to do something with the erroroffset without checking it for validity, in the worst case, this had the potential to lead to an RCE vulnerability. In case something similar ever happens again, I've added an assertion which will make it easier to notice the problem.
1 parent b72bf20 commit 36673bd

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

src/pcre2_compile.c

+2
Original file line numberDiff line numberDiff line change
@@ -11147,6 +11147,8 @@ an offset is available in the parsed pattern. */
1114711147
ptr = pattern + cb.erroroffset;
1114811148

1114911149
HAD_EARLY_ERROR:
11150+
PCRE2_ASSERT(ptr >= pattern); /* Ensure we don't return invalid erroroffset */
11151+
PCRE2_ASSERT(ptr < (pattern + patlen));
1115011152
*erroroffset = ptr - pattern;
1115111153

1115211154
HAD_ERROR:

0 commit comments

Comments
 (0)