ruby/backport-CVE-2019-16161.patch

32 lines
1.0 KiB
Diff

From 00cc7e28a3ed54b3b512ef3b58ea737a57acf1f9 Mon Sep 17 00:00:00 2001
From: "K.Takata" <kentkt@csc.jp>
Date: Mon, 29 Jul 2019 20:15:26 +0900
Subject: [PATCH] Fix SEGV in onig_error_code_to_str() (Fix #132)
When onig_new(ONIG_SYNTAX_PERL) fails with ONIGERR_INVALID_GROUP_NAME,
onig_error_code_to_str() crashes.
onig_scan_env_set_error_string() should have been used when returning
ONIGERR_INVALID_GROUP_NAME.
---
regparse.c | 6 +++++-
testpy.py | 1 +
2 files changed, 6 insertions(+), 1 deletion(-)
diff -Naur a/regparse.c b/regparse.c
--- a/regparse.c 2020-08-06 14:39:34.822618517 -0400
+++ b/regparse.c 2020-08-06 14:42:49.332618517 -0400
@@ -3891,7 +3891,11 @@
if (c == 'R' || c == '0') {
PINC; /* skip 'R' / '0' */
- if (!PPEEK_IS(')')) return ONIGERR_INVALID_GROUP_NAME;
+ if (!PPEEK_IS(')')) {
+ r = ONIGERR_INVALID_GROUP_NAME;
+ onig_scan_env_set_error_string(env, r, p - 1, p + 1);
+ return r;
+ }
PINC; /* skip ')' */
name_end = name = p;
gnum = 0;