Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
Overview
Comment: | 3610026 Stop crash when the number of "colors" in a regular expression overflows a short int. Thanks to Heikki Linnakangas for the report and the patch. |
---|---|
Downloads: | Tarball | ZIP archive | SQL archive |
Timelines: | family | ancestors | descendants | both | trunk |
Files: | files | file ages | folders |
SHA1: |
f8f456846fff2932546f0e88cfa655ac |
User & Date: | dgp 2013-04-08 20:07:07 |
Context
2013-04-08
| ||
20:29 | fix http package installation check-in: 106daecfca user: jan.nijtmans tags: trunk | |
20:07 | 3610026 Stop crash when the number of "colors" in a regular expression overflows a short int. Thank... check-in: f8f456846f user: dgp tags: trunk | |
19:59 | 3610026 Stop crash when the number of "colors" in a regular expression overflows a short int. Thank... check-in: a0f071f00b user: dgp tags: core-8-5-branch | |
15:58 | Documentation fix. check-in: e3d216f079 user: dgp tags: trunk | |
Changes
Changes to ChangeLog.
1 2 3 4 5 6 7 | 2013-04-04 Reinhard Max <[email protected]> * library/http/http.tcl (http::geturl): Allow URLs that don't have a path, but a query query, e.g. http://example.com?foo=bar . * Bump the http package to 2.8.7. 2013-03-22 Venkat Iyer <[email protected]> | > > > > > > > > | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 | 2013-04-08 Don Porter <[email protected]> * generic/regc_color.c: [Bug 3610026] Stop crash when the number of * generic/regerrs.h: "colors" in a regular expression overflows * generic/regex.h: a short int. Thanks to Heikki Linnakangas * generic/regguts.h: for the report and the patch. * tests/regexp.test: 2013-04-04 Reinhard Max <[email protected]> * library/http/http.tcl (http::geturl): Allow URLs that don't have a path, but a query query, e.g. http://example.com?foo=bar . * Bump the http package to 2.8.7. 2013-03-22 Venkat Iyer <[email protected]> |
︙ | ︙ |
Changes to generic/regc_color.c.
︙ | ︙ | |||
250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 | } else { struct colordesc *newCd; /* * Oops, must allocate more. */ n = cm->ncds * 2; if (cm->cd == cm->cdspace) { newCd = (struct colordesc *) MALLOC(n * sizeof(struct colordesc)); if (newCd != NULL) { memcpy(newCd, cm->cdspace, cm->ncds * sizeof(struct colordesc)); } } else { | > > > > > > > | 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 | } else { struct colordesc *newCd; /* * Oops, must allocate more. */ if (cm->max == MAX_COLOR) { CERR(REG_ECOLORS); return COLORLESS; /* too many colors */ } n = cm->ncds * 2; if (n < MAX_COLOR + 1) { n = MAX_COLOR + 1; } if (cm->cd == cm->cdspace) { newCd = (struct colordesc *) MALLOC(n * sizeof(struct colordesc)); if (newCd != NULL) { memcpy(newCd, cm->cdspace, cm->ncds * sizeof(struct colordesc)); } } else { |
︙ | ︙ |
Changes to generic/regerrs.h.
︙ | ︙ | |||
13 14 15 16 17 18 19 | { REG_ESPACE, "REG_ESPACE", "out of memory" }, { REG_BADRPT, "REG_BADRPT", "quantifier operand invalid" }, { REG_ASSERT, "REG_ASSERT", "\"can't happen\" -- you found a bug" }, { REG_INVARG, "REG_INVARG", "invalid argument to regex function" }, { REG_MIXED, "REG_MIXED", "character widths of regex and string differ" }, { REG_BADOPT, "REG_BADOPT", "invalid embedded option" }, { REG_ETOOBIG, "REG_ETOOBIG", "nfa has too many states" }, | > | 13 14 15 16 17 18 19 20 | { REG_ESPACE, "REG_ESPACE", "out of memory" }, { REG_BADRPT, "REG_BADRPT", "quantifier operand invalid" }, { REG_ASSERT, "REG_ASSERT", "\"can't happen\" -- you found a bug" }, { REG_INVARG, "REG_INVARG", "invalid argument to regex function" }, { REG_MIXED, "REG_MIXED", "character widths of regex and string differ" }, { REG_BADOPT, "REG_BADOPT", "invalid embedded option" }, { REG_ETOOBIG, "REG_ETOOBIG", "nfa has too many states" }, { REG_ECOLORS, "REG_ECOLORS", "too many colors" }, |
Changes to generic/regex.h.
︙ | ︙ | |||
277 278 279 280 281 282 283 284 285 286 287 288 289 290 | #define REG_ESPACE 12 /* out of memory */ #define REG_BADRPT 13 /* quantifier operand invalid */ #define REG_ASSERT 15 /* "can't happen" -- you found a bug */ #define REG_INVARG 16 /* invalid argument to regex function */ #define REG_MIXED 17 /* character widths of regex and string differ */ #define REG_BADOPT 18 /* invalid embedded option */ #define REG_ETOOBIG 19 /* nfa has too many states */ /* two specials for debugging and testing */ #define REG_ATOI 101 /* convert error-code name to number */ #define REG_ITOA 102 /* convert error-code number to name */ /* * the prototypes, as possibly munched by regfwd */ | > | 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 | #define REG_ESPACE 12 /* out of memory */ #define REG_BADRPT 13 /* quantifier operand invalid */ #define REG_ASSERT 15 /* "can't happen" -- you found a bug */ #define REG_INVARG 16 /* invalid argument to regex function */ #define REG_MIXED 17 /* character widths of regex and string differ */ #define REG_BADOPT 18 /* invalid embedded option */ #define REG_ETOOBIG 19 /* nfa has too many states */ #define REG_ECOLORS 20 /* too many colors */ /* two specials for debugging and testing */ #define REG_ATOI 101 /* convert error-code name to number */ #define REG_ITOA 102 /* convert error-code number to name */ /* * the prototypes, as possibly munched by regfwd */ |
︙ | ︙ |
Changes to generic/regguts.h.
︙ | ︙ | |||
141 142 143 144 145 146 147 148 149 150 151 152 153 154 | /* * As soon as possible, we map chrs into equivalence classes -- "colors" -- * which are of much more manageable number. */ typedef short color; /* colors of characters */ typedef int pcolor; /* what color promotes to */ #define COLORLESS (-1) /* impossible color */ #define WHITE 0 /* default color, parent of all others */ /* * A colormap is a tree -- more precisely, a DAG -- indexed at each level by a * byt of the chr, to map the chr to a color efficiently. Because lower * sections of the tree can be shared, it can exploit the usual sparseness of | > | 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 | /* * As soon as possible, we map chrs into equivalence classes -- "colors" -- * which are of much more manageable number. */ typedef short color; /* colors of characters */ typedef int pcolor; /* what color promotes to */ #define MAX_COLOR SHRT_MAX /* max color value */ #define COLORLESS (-1) /* impossible color */ #define WHITE 0 /* default color, parent of all others */ /* * A colormap is a tree -- more precisely, a DAG -- indexed at each level by a * byt of the chr, to map the chr to a color efficiently. Because lower * sections of the tree can be shared, it can exploit the usual sparseness of |
︙ | ︙ |
Changes to tests/regexp.test.
︙ | ︙ | |||
861 862 863 864 865 866 867 868 869 870 871 872 873 874 | [a 671]([a 55])[a 669]([a 55])[a 668]([a 55])[a 669]([a 55]) \ [a 669]([a 55])[a 669]([a 55])[a 668]([a 55])[a 669]([a 55]) \ [a 668]([a 55])[a 710]([a 55])[a 668]([a 55])[a 668]([a 55]) \ [a 668]([a 55])[a 668]([a 55])[a 668]([a 55])[a 511]] {}] a } -cleanup { rename a {} } -returnCodes 1 -result {couldn't compile regular expression pattern: nfa has too many states} test regexp-23.1 {regexp -all and -line} { set string "" list \ [regexp -all -inline -indices -line -- {^} $string] \ [regexp -all -inline -indices -line -- {^$} $string] \ [regexp -all -inline -indices -line -- {$} $string] | > > > > > > > > > > > | 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885 | [a 671]([a 55])[a 669]([a 55])[a 668]([a 55])[a 669]([a 55]) \ [a 669]([a 55])[a 669]([a 55])[a 668]([a 55])[a 669]([a 55]) \ [a 668]([a 55])[a 710]([a 55])[a 668]([a 55])[a 668]([a 55]) \ [a 668]([a 55])[a 668]([a 55])[a 668]([a 55])[a 511]] {}] a } -cleanup { rename a {} } -returnCodes 1 -result {couldn't compile regular expression pattern: nfa has too many states} test regexp-22.5 {Bug 3610026} -setup { set e {} set cp 99 while {$cp < 32864} { append e [format %c [incr cp]] } } -body { regexp -about $e } -cleanup { unset -nocomplain e cp } -returnCodes error -match glob -result {*too many colors*} test regexp-23.1 {regexp -all and -line} { set string "" list \ [regexp -all -inline -indices -line -- {^} $string] \ [regexp -all -inline -indices -line -- {^$} $string] \ [regexp -all -inline -indices -line -- {$} $string] |
︙ | ︙ |