From owner-svn-src-head@FreeBSD.ORG Sat Feb 14 00:36:59 2015 Return-Path: Delivered-To: svn-src-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 714A3AD2 for ; Sat, 14 Feb 2015 00:36:59 +0000 (UTC) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:1900:2254:206c::16:87]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 513061EB for ; Sat, 14 Feb 2015 00:36:59 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.9/8.14.9) with ESMTP id t1E0axpn073298 for ; Sat, 14 Feb 2015 00:36:59 GMT (envelope-from bdrewery@freefall.freebsd.org) Received: (from bdrewery@localhost) by freefall.freebsd.org (8.14.9/8.14.9/Submit) id t1E0axvr073297 for svn-src-head@freebsd.org; Sat, 14 Feb 2015 00:36:59 GMT (envelope-from bdrewery) Received: (qmail 1477 invoked from network); 13 Feb 2015 18:36:54 -0600 Received: from unknown (HELO ?10.10.1.139?) (freebsd@shatow.net@10.10.1.139) by sweb.xzibition.com with ESMTPA; 13 Feb 2015 18:36:54 -0600 Message-ID: <54DE98AC.6030309@FreeBSD.org> Date: Fri, 13 Feb 2015 18:37:00 -0600 From: Bryan Drewery Organization: FreeBSD User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.4.0 MIME-Version: 1.0 To: Xin LI , src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: Re: svn commit: r278739 - head/lib/libc/regex References: <201502140023.t1E0Nspc090570@svn.freebsd.org> In-Reply-To: <201502140023.t1E0Nspc090570@svn.freebsd.org> OpenPGP: id=6E4697CF; url=http://www.shatow.net/bryan/bryan2.asc Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="uTloE2vHloF2tHifITEeF6uufJiomIxOU" X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 14 Feb 2015 00:36:59 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --uTloE2vHloF2tHifITEeF6uufJiomIxOU Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 2/13/2015 6:23 PM, Xin LI wrote: > Author: delphij > Date: Sat Feb 14 00:23:53 2015 > New Revision: 278739 > URL: https://svnweb.freebsd.org/changeset/base/278739 >=20 > Log: > Disallow pattern spaces which would cause intermediate calculations t= o > overflow size_t. > =20 > Obtained from: DragonFly (2841837793bd095a82f477e9c370cfe6cfb3862c di= llon) > Security: CERT VU#695940 > MFC after: 3 days >=20 > Modified: > head/lib/libc/regex/regcomp.c >=20 > Modified: head/lib/libc/regex/regcomp.c > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D > --- head/lib/libc/regex/regcomp.c Sat Feb 14 00:03:43 2015 (r278738) > +++ head/lib/libc/regex/regcomp.c Sat Feb 14 00:23:53 2015 (r278739) > @@ -192,6 +192,7 @@ regcomp(regex_t * __restrict preg, > struct parse *p =3D &pa; > int i; > size_t len; > + size_t maxlen; > #ifdef REDEBUG > # define GOODFLAGS(f) (f) > #else > @@ -213,7 +214,23 @@ regcomp(regex_t * __restrict preg, > g =3D (struct re_guts *)malloc(sizeof(struct re_guts)); > if (g =3D=3D NULL) > return(REG_ESPACE); > + /* > + * Limit the pattern space to avoid a 32-bit overflow on buffer > + * extension. Also avoid any signed overflow in case of conversion > + * so make the real limit based on a 31-bit overflow. > + * > + * Likely not applicable on 64-bit systems but handle the case > + * generically (who are we to stop people from using ~715MB+ > + * patterns?). > + */ > + maxlen =3D ((size_t)-1 >> 1) / sizeof(sop) * 2 / 3; > + if (len >=3D maxlen) { > + free((char *)g); I was planning to submit a patch for review to remove all of this casting / and discuss. In this example the malloc is casted to struct re_gets* but the free is casted to char *. Why different and why cast in free at all? --=20 Regards, Bryan Drewery --uTloE2vHloF2tHifITEeF6uufJiomIxOU Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBAgAGBQJU3pitAAoJEDXXcbtuRpfPTRYH/2m4BQpQq5cS9w9U2P4vo/al Ka4lJYfbB6kY6QvEWO3A6OmvBwSGQFgm3nfSO8+Gc6o0ObkHvlJvuoaaYOEGyaBJ JJ3d4jfME10R+H11SI/f19BWZJxDCdwOdV0yF3lmTG1pGM/XCNHt8vfZmKCONp3z LOKrdZ4QU4ErI5HYkPBOPYrT7CD+Sv9744Um/ME1UE3ahOBDILMqgJxtvKVV+iCB /j3LzzH0nVpc79KWRnEDgzJQP8PJqVsZPrKf2ynpqb6YRN16zuWxV3qs61TYlewZ zfkImFbcNzIuWU/hg/gO2Q7hstCMyBHr59QvaUh5xRMB/un3xOci7TAyq6DR37s= =0uVo -----END PGP SIGNATURE----- --uTloE2vHloF2tHifITEeF6uufJiomIxOU--