From: Matthew Vernon <matthew@debian.org>
Date: Thu, 18 Jun 2020 18:32:51 +0000 (+0100)
Subject: upstream patch fixing CVE-2020-14155
X-Git-Tag: archive/debian/2%8.39-13~2
X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~matthewv/git?a=commitdiff_plain;h=7b88c83f87391950756256072f886a08c44ed78f;p=pcre3.git

upstream patch fixing CVE-2020-14155

This checks the size of the number after (?C as it is read, in order
to avoid integer overflow.
---

diff --git a/pcre_compile.c b/pcre_compile.c
index 7cd3950..c742227 100644
--- a/pcre_compile.c
+++ b/pcre_compile.c
@@ -7086,17 +7086,19 @@ for (;; ptr++)
           int n = 0;
           ptr++;
           while(IS_DIGIT(*ptr))
+            { 
             n = n * 10 + *ptr++ - CHAR_0;
+            if (n > 255)
+              {
+              *errorcodeptr = ERR38;
+              goto FAILED;
+              }
+            } 
           if (*ptr != CHAR_RIGHT_PARENTHESIS)
             {
             *errorcodeptr = ERR39;
             goto FAILED;
             }
-          if (n > 255)
-            {
-            *errorcodeptr = ERR38;
-            goto FAILED;
-            }
           *code++ = n;
           PUT(code, 0, (int)(ptr - cd->start_pattern + 1)); /* Pattern offset */
           PUT(code, LINK_SIZE, 0);                          /* Default length */