001-CVE-2017-7186 (1796B)
1 #CVE-2017-7186 patch 2 --- trunk/pcre_internal.h 2016/05/21 13:34:44 1649 3 +++ trunk/pcre_internal.h 2017/02/24 17:30:30 1688 4 @@ -2772,6 +2772,9 @@ 5 extern const pcre_uint16 PRIV(ucd_stage2)[]; 6 extern const pcre_uint32 PRIV(ucp_gentype)[]; 7 extern const pcre_uint32 PRIV(ucp_gbtable)[]; 8 +#ifdef COMPILE_PCRE32 9 +extern const ucd_record PRIV(dummy_ucd_record)[]; 10 +#endif 11 #ifdef SUPPORT_JIT 12 extern const int PRIV(ucp_typerange)[]; 13 #endif 14 @@ -2780,9 +2783,15 @@ 15 /* UCD access macros */ 16 17 #define UCD_BLOCK_SIZE 128 18 -#define GET_UCD(ch) (PRIV(ucd_records) + \ 19 +#define REAL_GET_UCD(ch) (PRIV(ucd_records) + \ 20 PRIV(ucd_stage2)[PRIV(ucd_stage1)[(int)(ch) / UCD_BLOCK_SIZE] * \ 21 UCD_BLOCK_SIZE + (int)(ch) % UCD_BLOCK_SIZE]) 22 + 23 +#ifdef COMPILE_PCRE32 24 +#define GET_UCD(ch) ((ch > 0x10ffff)? PRIV(dummy_ucd_record) : REAL_GET_UCD(ch)) 25 +#else 26 +#define GET_UCD(ch) REAL_GET_UCD(ch) 27 +#endif 28 29 #define UCD_CHARTYPE(ch) GET_UCD(ch)->chartype 30 #define UCD_SCRIPT(ch) GET_UCD(ch)->script 31 --- trunk/pcre_ucd.c 2014/06/19 07:51:39 1490 32 +++ trunk/pcre_ucd.c 2017/02/24 17:30:30 1688 33 @@ -38,6 +38,20 @@ 34 const pcre_uint32 PRIV(ucd_caseless_sets)[] = {0}; 35 #else 36 37 +/* If the 32-bit library is run in non-32-bit mode, character values 38 +greater than 0x10ffff may be encountered. For these we set up a 39 +special record. */ 40 + 41 +#ifdef COMPILE_PCRE32 42 +const ucd_record PRIV(dummy_ucd_record)[] = {{ 43 + ucp_Common, /* script */ 44 + ucp_Cn, /* type unassigned */ 45 + ucp_gbOther, /* grapheme break property */ 46 + 0, /* case set */ 47 + 0, /* other case */ 48 + }}; 49 +#endif 50 + 51 /* When recompiling tables with a new Unicode version, please check the 52 types in this structure definition from pcre_internal.h (the actual 53 field names will be different):