Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 836372 (CVE-2022-23901)

Summary: <dev-util/re2c-3.1: infinite recursion
Product: Gentoo Security Reporter: John Helmert III <ajak>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: CONFIRMED ---    
Severity: minor CC: eschwartz93, robbat2
Priority: Normal Keywords: PullRequest
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://github.com/skvadrik/re2c/issues/394
See Also: https://github.com/gentoo/gentoo/pull/34681
https://github.com/gentoo/gentoo/pull/32679
Whiteboard: B3 [stable?]
Package list:
Runtime testing required: ---

Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-03-29 14:43:28 UTC
CVE-2022-23901:

A stack overflow re2c 2.2 exists due to infinite recursion issues in src/dfa/dead_rules.cc.

Patches in 3.0:

https://github.com/skvadrik/re2c/commit/a3473fd7be829cb33907cb08612f955133c70a96
https://github.com/skvadrik/re2c/commit/039c18949190c5de5397eba504d2c75dad2ea9ca
Comment 1 Larry the Git Cow gentoo-dev 2024-01-20 13:33:46 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a2aa8ccd3c1522c88386de4904d4bf77fcafb0d8

commit a2aa8ccd3c1522c88386de4904d4bf77fcafb0d8
Author:     Christopher Fore <csfore@posteo.net>
AuthorDate: 2024-01-07 00:35:48 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2024-01-20 13:27:19 +0000

    dev-util/re2c: add 3.1, security bump
    
    [sam: Add explicit --enable-rust like for Go. It's already on by default though.]
    
    Bug: https://bugs.gentoo.org/836372
    Signed-off-by: Christopher Fore <csfore@posteo.net>
    Closes: https://github.com/gentoo/gentoo/pull/34681
    Signed-off-by: Sam James <sam@gentoo.org>

 dev-util/re2c/Manifest        |  1 +
 dev-util/re2c/re2c-3.1.ebuild | 41 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+)
Comment 2 Eli Schwartz 2024-06-04 20:48:45 UTC
Someone else submitted an earlier PR but a missing tag made it go unnoticed. :(