blob: fc783e8a150941503558f17a24e5dff0080738b6 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
|
commit f015fbdd95f76438cd86366467bb2b39870dd7c6
Author: K.Kosako <kosako@sofnec.co.jp>
Date: Fri May 19 15:44:47 2017 +0900
fix #55 : Byte value expressed in octal must be smaller than 256
Upstream-Status: Backport
CVE: CVE-2017-9226
Signed-off-by: Thiruvadi Rajaraman <tajaraman@mvista.com>
Index: ruby-2.2.5/regparse.c
===================================================================
--- ruby-2.2.5.orig/regparse.c 2017-09-12 16:33:21.977835068 +0530
+++ ruby-2.2.5/regparse.c 2017-09-12 16:34:40.987117744 +0530
@@ -3222,7 +3222,7 @@
PUNFETCH;
prev = p;
num = scan_unsigned_octal_number(&p, end, 3, enc);
- if (num < 0) return ONIGERR_TOO_BIG_NUMBER;
+ if (num < 0 || num >= 256) return ONIGERR_TOO_BIG_NUMBER;
if (p == prev) { /* can't read nothing. */
num = 0; /* but, it's not error */
}
@@ -3676,7 +3676,7 @@
if (IS_SYNTAX_OP(syn, ONIG_SYN_OP_ESC_OCTAL3)) {
prev = p;
num = scan_unsigned_octal_number(&p, end, (c == '0' ? 2:3), enc);
- if (num < 0) return ONIGERR_TOO_BIG_NUMBER;
+ if (num < 0 || num >= 256) return ONIGERR_TOO_BIG_NUMBER;
if (p == prev) { /* can't read nothing. */
num = 0; /* but, it's not error */
}
|