This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch xerces-3.3
in repository https://gitbox.apache.org/repos/asf/xerces-c.git
The following commit(s) were added to refs/heads/xerces-3.3 by this push:
new 5a5bc2b85 XERCESC-2268 - Regexp parser should bound cardinality
5a5bc2b85 is described below
commit 5a5bc2b8581806c35052c523d95efeaf21c122ca
Author: Scott Cantor <[email protected]>
AuthorDate: Thu Aug 13 12:56:31 2026 -0400
XERCESC-2268 - Regexp parser should bound cardinality
https://issues.apache.org/jira/browse/XERCESC-2268
---
src/xercesc/util/regx/RegularExpression.hpp | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/src/xercesc/util/regx/RegularExpression.hpp
b/src/xercesc/util/regx/RegularExpression.hpp
index 6133ebd81..4cee6c7f9 100644
--- a/src/xercesc/util/regx/RegularExpression.hpp
+++ b/src/xercesc/util/regx/RegularExpression.hpp
@@ -25,6 +25,7 @@
// ---------------------------------------------------------------------------
// Includes
// ---------------------------------------------------------------------------
+#include <xercesc/util/IllegalArgumentException.hpp>
#include <xercesc/util/RefArrayVectorOf.hpp>
#include <xercesc/util/XMLString.hpp>
#include <xercesc/util/Janitor.hpp>
@@ -43,6 +44,8 @@ class RangeToken;
class Match;
class RegxParser;
+#define XERCESC_REGX_QUANTIFIER_LIMIT 1000000
+
/**
* The RegularExpression class represents a parsed executable regular
expression.
* This class is thread safe. Two similar regular expression syntaxes are
@@ -699,6 +702,10 @@ protected:
int min = token->getMin();
int max = token->getMax();
+ if (max > XERCESC_REGX_QUANTIFIER_LIMIT) {
+ ThrowXMLwithMemMgr(IllegalArgumentException,
XMLExcepts::Regex_NotSupported, fMemoryManager);
+ }
+
if (min >= 0 && min == max) {
ret = next;
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
