| From c4603ba5ce229db83a2a4fb93e6d4b4e3ec3776a Mon Sep 17 00:00:00 2001 |
| From: Ulya Trofimovich <skvadrik@gmail.com> |
| Date: Fri, 17 Apr 2020 22:47:14 +0100 |
| Subject: [PATCH] Fix crash in lexer refill (reported by Agostino Sarubbo). |
| |
| The crash happened in a rare case of a very long lexeme that doen't fit |
| into the buffer, forcing buffer reallocation. |
| |
| The crash was caused by an incorrect calculation of the shift offset |
| (it was smaller than necessary). As a consequence, the data from buffer |
| start and up to the beginning of the current lexeme was not discarded |
| (as it should have been), resulting in less free space for new data than |
| expected. |
| |
| Upstream-Status: Backport [https://github.com/skvadrik/re2c/commit/c4603ba5ce229db83a2a4fb93e6d4b4e3ec3776a] |
| CVE: CVE-2020-11958 |
| Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> |
| --- |
| src/parse/scanner.cc | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| diff --git a/src/parse/scanner.cc b/src/parse/scanner.cc |
| index 1d6e9efa..bd651314 100644 |
| --- a/src/parse/scanner.cc |
| +++ b/src/parse/scanner.cc |
| @@ -155,13 +155,14 @@ bool Scanner::fill(size_t need) |
| if (!buf) fatal("out of memory"); |
| |
| memmove(buf, tok, copy); |
| - shift_ptrs_and_fpos(buf - bot); |
| + shift_ptrs_and_fpos(buf - tok); |
| delete [] bot; |
| bot = buf; |
| |
| free = BSIZE - copy; |
| } |
| |
| + DASSERT(lim + free <= bot + BSIZE); |
| if (!read(free)) { |
| eof = lim; |
| memset(lim, 0, YYMAXFILL); |