Skip to content

Commit

Permalink
Use assertion to ensure erroroffset return from pcre2_compile is valid
Browse files Browse the repository at this point in the history
When testing the new pattern rewriting phase for regex compilation using
a fuzzer, I had a scary experience. Due to a bug in my pattern rewriting
code, pcre2_compile() could return a totally invalid erroroffset. If a
library user tried to do something with the erroroffset without checking
it for validity, in the worst case, this had the potential to lead to an
RCE vulnerability.

In case something similar ever happens again, I've added an assertion
which will make it easier to notice the problem.
  • Loading branch information
alexdowad committed Sep 3, 2024
1 parent b72bf20 commit 36673bd
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions src/pcre2_compile.c
Original file line number Diff line number Diff line change
Expand Up @@ -11147,6 +11147,8 @@ an offset is available in the parsed pattern. */
ptr = pattern + cb.erroroffset;

HAD_EARLY_ERROR:
PCRE2_ASSERT(ptr >= pattern); /* Ensure we don't return invalid erroroffset */
PCRE2_ASSERT(ptr < (pattern + patlen));
*erroroffset = ptr - pattern;

HAD_ERROR:
Expand Down

0 comments on commit 36673bd

Please sign in to comment.