Merge pull request #97 from dag-erling/des/bad-bounds

Fix bugs in bound handling
laurikari · Jun 30, 2024 · ca34130 · ca34130
2 parents 96b4cac + f4dd24c
commit ca34130
Show file tree

Hide file tree

Showing 3 changed files with 43 additions and 9 deletions.
diff --git a/lib/tre-parse.c b/lib/tre-parse.c
@@ -576,22 +576,35 @@ tre_parse_bracket(tre_parse_ctx_t *ctx, tre_ast_node_t **result)
 }
 
 
-/* Parses a positive decimal integer.  Returns -1 if the string does not
-   contain a valid number. */
+/* Parses a positive decimal integer capped at INT_MAX.  Returns -1 if the
+   string does not contain a valid number. */
 static int
 tre_parse_int(const tre_char_t **regex, const tre_char_t *regex_end)
 {
-  int num = -1;
+  unsigned long num = 0;
+  int overflow = 0;
   const tre_char_t *r = *regex;
   while (r < regex_end && *r >= L'0' && *r <= L'9')
     {
-      if (num < 0)
-	num = 0;
-      num = num * 10 + *r - L'0';
+      if (!overflow)
+	{
+	  if (num * 10 + *r - L'0' < num)
+	    {
+	      overflow = 1;
+	    }
+	  else
+	    {
+	      num = num * 10 + *r - L'0';
+	      if (num > INT_MAX)
+		overflow = 1;
+	    }
+	}
       r++;
     }
+  if (r == *regex)
+    return -1;
   *regex = r;
-  return num;
+  return overflow ? INT_MAX : (int)num;
 }
 
 
@@ -630,7 +643,7 @@ tre_parse_bound(tre_parse_ctx_t *ctx, tre_ast_node_t **result)
   /* Check that the repeat counts are sane. */
   if (max >= 0 && min > max)
     return REG_BADBR;
-  if (max > RE_DUP_MAX)
+  if (min > RE_DUP_MAX || max > RE_DUP_MAX)
     return REG_BADMAX;
 
 

diff --git a/local_includes/tre.h b/local_includes/tre.h
@@ -74,7 +74,7 @@ typedef int reg_errcode_t;
 #endif
 
 /* Extra tre_regcomp() return error codes. */
-#define REG_BADMAX REG_BADPAT
+#define REG_BADMAX REG_BADBR
 
 /* Extra tre_regcomp() flags. */
 #ifndef REG_BASIC

diff --git a/tests/retest.c b/tests/retest.c
@@ -1421,6 +1421,27 @@ main(int argc, char **argv)
   test_exec("parabc123wxyz", 0, REG_OK, 3, 13, END);
   test_exec("fooabc123wxyz", 0, REG_OK, 0, 3, END);
 
+  /*
+   * Test integer parser used for bounded repititions.
+   */
+
+  test_comp("a{9223372036854775808,}", REG_EXTENDED, REG_BADMAX);
+  test_comp("a{9223372036854775808}", REG_EXTENDED, REG_BADMAX);
+  test_comp("a{9223372036854775807,}", REG_EXTENDED, REG_BADMAX);
+  test_comp("a{9223372036854775807}", REG_EXTENDED, REG_BADMAX);
+  test_comp("a{2147483648,}", REG_EXTENDED, REG_BADMAX);
+  test_comp("a{2147483648}", REG_EXTENDED, REG_BADMAX);
+  test_comp("a{2147483647,}", REG_EXTENDED, REG_BADMAX);
+  test_comp("a{2147483647}", REG_EXTENDED, REG_BADMAX);
+  test_comp("a{32768,}", REG_EXTENDED, REG_BADMAX);
+  test_comp("a{32768}", REG_EXTENDED, REG_BADMAX);
+  test_comp("a{32767,}", REG_EXTENDED, REG_BADMAX);
+  test_comp("a{32767}", REG_EXTENDED, REG_BADMAX);
+  test_comp("a{256,}", REG_EXTENDED, REG_BADMAX);
+  test_comp("a{256}", REG_EXTENDED, REG_BADMAX);
+  test_comp("a{255,}", REG_EXTENDED, REG_OK);
+  test_comp("a{255}", REG_EXTENDED, REG_OK);
+
   /*
    * Test bounded repetitions.
    */