[patch] replacement patch

07_all_1.34.1-CVE-2008-0171_and_0172.patch.corrected (text/plain), 2.48 KB, created by Randy Johnson on 2008-01-26 04:59:55 UTC

Index: /trunk/boost/regex/v4/basic_regex_parser.hpp
===================================================================
--- boost/regex/v4/basic_regex_parser.hpp.orig	2008-01-25 23:40:35.000000000 -0500
+++ boost/regex/v4/basic_regex_parser.hpp	2008-01-25 23:44:10.000000000 -0500
@@ -777,6 +777,7 @@
       case syntax_element_restart_continue:
       case syntax_element_jump:
       case syntax_element_startmark:
+      case syntax_element_backstep:
          // can't legally repeat any of the above:
          fail(regex_constants::error_badrepeat, m_position - m_base);
          return false;
@@ -1862,6 +1863,7 @@
    if(markid == -4)
    {
       re_syntax_base* b = this->getaddress(expected_alt_point);
+      // Make sure we have exactly one alternative following this state:
       if(b->type != syntax_element_alt)
       {
          re_alt* alt = static_cast<re_alt*>(this->insert_state(expected_alt_point, syntax_element_alt, sizeof(re_alt)));
@@ -1872,11 +1874,20 @@
          fail(regex_constants::error_bad_pattern, m_position - m_base);
          return false;
       }
+      // check for invalid repetition of next state:
+      b = this->getaddress(expected_alt_point);
+      b = this->getaddress(static_cast<re_alt*>(b)->next.i, b);
+      if((b->type != syntax_element_assert_backref)
+         && (b->type != syntax_element_startmark))
+      {
+         fail(regex_constants::error_badrepeat, m_position - m_base);
+      }
    }
    //
    // append closing parenthesis state:
    //
    pb = static_cast<re_brace*>(this->append_state(syntax_element_endmark, sizeof(re_brace)));
+         return false;
    pb->index = markid;
    this->m_paren_start = last_paren_start;
    //
Index: /trunk/libs/regex/test/regress/test_perl_ex.cpp
===================================================================
--- libs/regex/test/regress/test_perl_ex.cpp (revision 30980)
+++ libs/regex/test/regress/test_perl_ex.cpp (revision 42674)
@@ -122,4 +122,15 @@
    TEST_INVALID_REGEX("(?:(a)|b)(?(?<", perl);
    TEST_INVALID_REGEX("(?:(a)|b)(?(?<a", perl);
+
+   TEST_INVALID_REGEX("(?(?!#?)+)", perl);
+   TEST_INVALID_REGEX("(?(?=:-){0})", perl);
+   TEST_INVALID_REGEX("(?(123){1})", perl);
+   TEST_INVALID_REGEX("(?(?<=A)*)", perl);
+   TEST_INVALID_REGEX("(?(?<=A)+)", perl);
+
+   TEST_INVALID_REGEX("(?<!*|^)", perl);
+   TEST_INVALID_REGEX("(?<!*|A)", perl);
+   TEST_INVALID_REGEX("(?<=?|A)", perl);
+   TEST_INVALID_REGEX("(?<=*|\\B)", perl);
 }