[patch] Upstream fix for CVE-2017-6004 with updated tests

CVE-2017-6004-full.patch (text/plain), 1.47 KB, created by Thomas Deutschmann (RETIRED) on 2017-02-17 07:41:37 UTC

Index: testdata/testinput12
===================================================================
--- testdata/testinput12	(revision 1679)
+++ testdata/testinput12	(revision 1680)
@@ -104,4 +104,6 @@
 /(.|.)*?bx/
     aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabax
 
+/((?(?!))x)(?'name')(?1)/S++
+
 /-- End of testinput12 --/
Index: testdata/testoutput12
===================================================================
--- testdata/testoutput12	(revision 1679)
+++ testdata/testoutput12	(revision 1680)
@@ -201,4 +201,6 @@
     aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabax
 Error -8 (match limit exceeded)
 
+/((?(?!))x)(?'name')(?1)/S++
+
 /-- End of testinput12 --/
Index: pcre_jit_compile.c
===================================================================
--- pcre_jit_compile.c	(revision 1679)
+++ pcre_jit_compile.c	(revision 1680)
@@ -8110,7 +8110,7 @@
 
     if (*matchingpath == OP_FAIL)
       stacksize = 0;
-    if (*matchingpath == OP_RREF)
+    else if (*matchingpath == OP_RREF)
       {
       stacksize = GET2(matchingpath, 1);
       if (common->currententry == NULL)
Index: ChangeLog
===================================================================
--- ChangeLog	(revision 1679)
+++ ChangeLog	(revision 1680)
@@ -15,7 +15,9 @@
 next line instead of moving on to the end of the matched string, which can be 
 several lines after the start.
 
+3.  Fix a missing else in the JIT compiler reported by 'idaifish'.
 
+
 Version 8.40 11-January-2017
 ----------------------------