Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

pcre2test: avoid printing invalid utf trail in partial match #237

Merged
merged 1 commit into from
Apr 21, 2023

Conversation

carenas
Copy link
Contributor

@carenas carenas commented Apr 20, 2023

This could result in a buffer over read as reported in the linked ticket and that was only possible after 10.34 when match_invalid_utf was introduced, or if invalid data was matched without UTF validation, which is known to have undefined behaviour.

Also makes utf82ord() save when used with invalid UTF, as the same issue could be triggered in other ways (ex: using aftertext) as shown by:

PCRE2 version 10.34 2019-11-21
  re> /(?<=..)X/match_invalid_utf,aftertext
data> \xc3\xb1x{10ffff}X\xb1\xf4\x8f\xbf

Fixes: #235

@PhilipHazel
Copy link
Collaborator

The tests are failing with JIT, it seems.

@carenas
Copy link
Contributor Author

carenas commented Apr 20, 2023

Shouldn't fail when stacked on top of #238, but will update it once that is settled

When match_invalid_utf is enabled, invalid UTF-8 data can't match
but it was mistakenly getting printed as part of a partial match
eventhough the ovector correctly didn't include it, as shown by:

  PCRE2 version 10.34 2019-11-21
    re> /(?<=..)X/match_invalid_utf,allvector
  data> XX\x80\=ph,ovector=1
  Partial match: \x{80}
  ** ovector[1] is not equal to the subject length: 2 != 3
   0: 2 2

Fix the logic to print instead the empty match that was returned
and address a buffer overread when trying to decode UTF-8 that was
missing code units.

Fixes: PCRE2Project#235
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Heap-Buffer-Overflow in pcre2(src/pcre2test.c:2945:7 in utf82ord)
2 participants