From owner-freebsd-bugs@FreeBSD.ORG Sun May 4 03:00:01 2014 Return-Path: Delivered-To: freebsd-bugs@smarthost.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 4FDD69E7 for ; Sun, 4 May 2014 03:00:01 +0000 (UTC) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:1900:2254:206c::16:87]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 20BA41291 for ; Sun, 4 May 2014 03:00:01 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.8/8.14.8) with ESMTP id s44300XY038644 for ; Sun, 4 May 2014 03:00:00 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.8/8.14.8/Submit) id s44300eP038643; Sun, 4 May 2014 03:00:00 GMT (envelope-from gnats) Date: Sun, 4 May 2014 03:00:00 GMT Message-Id: <201405040300.s44300eP038643@freefall.freebsd.org> To: freebsd-bugs@FreeBSD.org Cc: From: Pedro Giffuni Subject: Re: kern/169302: [libc] [patch] Applied MidnightBSD regex memory consumption limits X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: Pedro Giffuni List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 04 May 2014 03:00:01 -0000 The following reply was made to PR kern/169302; it has been noted by GNATS. From: Pedro Giffuni To: "bug-followup@FreeBSD.org" , "zblacher@sandvine.com" Cc: Subject: Re: kern/169302: [libc] [patch] Applied MidnightBSD regex memory consumption limits Date: Sat, 3 May 2014 19:54:04 -0700 (PDT) ---1130188905-1388205096-1399172044=:87984 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Nice!=0AThe patch doesn't apply cleanly but it seems related to this commit= in NetBSD:=0A=0A"Prevent regcomp/regexec DoS attacks by limiting the amoun= t of memory used=0Aand the level of recursion. Thanks to Maksymilian Arciem= owicz for discovery=0Aand help with the implementation."=0A=0Ahttp://cvsweb= .netbsd.org/bsdweb.cgi/src/lib/libc/regex/regcomp.c.diff?r1=3D1.29&r2=3D1.3= 0&only_with_tag=3DMAIN=0A ---1130188905-1388205096-1399172044=:87984 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Nice!
The patch doesn't apply cleanly but it seems related to this commit i= n NetBSD:

<= div class=3D"" style=3D"color: rgb(0, 0, 0); font-size: 16px; font-family: = HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,Sans-Serif; back= ground-color: transparent; font-style: normal">"Prevent regcomp/regexec DoS= attacks by limiting the amount of memory used
and= the level of recursion. Thanks to Maksymilian Arciemowicz for discoveryand help with the implementation."

http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/regex/regcom= p.c.diff?r1=3D1.29&r2=3D1.30&only_with_tag=3DMAIN
---1130188905-1388205096-1399172044=:87984--