Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 836372 (CVE-2022-23901) - <dev-util/re2c-3.1: infinite recursion
Summary: <dev-util/re2c-3.1: infinite recursion
Status: CONFIRMED
Alias: CVE-2022-23901
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor
Assignee: Gentoo Security
URL: https://github.com/skvadrik/re2c/issu...
Whiteboard: B3 [stable]
Keywords: PullRequest
Depends on: 937346
Blocks:
  Show dependency tree
 
Reported: 2022-03-29 14:43 UTC by John Helmert III
Modified: 2024-10-17 12:12 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-03-29 14:43:28 UTC 
CVE-2022-23901:

A stack overflow re2c 2.2 exists due to infinite recursion issues in src/dfa/dead_rules.cc.

Patches in 3.0:

https://github.com/skvadrik/re2c/commit/a3473fd7be829cb33907cb08612f955133c70a96
https://github.com/skvadrik/re2c/commit/039c18949190c5de5397eba504d2c75dad2ea9ca
Comment 1 Larry the Git Cow gentoo-dev 2024-01-20 13:33:46 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a2aa8ccd3c1522c88386de4904d4bf77fcafb0d8

commit a2aa8ccd3c1522c88386de4904d4bf77fcafb0d8
Author:     Christopher Fore <csfore@posteo.net>
AuthorDate: 2024-01-07 00:35:48 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2024-01-20 13:27:19 +0000

    dev-util/re2c: add 3.1, security bump
    
    [sam: Add explicit --enable-rust like for Go. It's already on by default though.]
    
    Bug: https://bugs.gentoo.org/836372
    Signed-off-by: Christopher Fore <csfore@posteo.net>
    Closes: https://github.com/gentoo/gentoo/pull/34681
    Signed-off-by: Sam James <sam@gentoo.org>

 dev-util/re2c/Manifest        |  1 +
 dev-util/re2c/re2c-3.1.ebuild | 41 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+)
Comment 2 Eli Schwartz gentoo-dev 2024-06-04 20:48:45 UTC 
Someone else submitted an earlier PR but a missing tag made it go unnoticed. :(