------- You are receiving this mail because: ------- You are on the CC list for the bug.
http://bugs.exim.org/show_bug.cgi?id=1236 Summary: Potential buffer overflow of ovector in pcre_exec() Product: PCRE Version: 8.30 Platform: x86-64 OS/Version: Linux Status: NEW Severity: security Priority: high Component: Code AssignedTo: [email protected] ReportedBy: [email protected] CC: [email protected] Looks like in 8.30 there may be the potential for a buffer overflow of the ovector in pcre_exec. See attached C file. If ovector is on the stack, sometimes get a segfault. Dynamically allocated, get valgrind errors about invalid writes: [twease@twease-computer pcre-segfault]$ gcc pcre-poc.c -o pcre-poc -I /usr/local/include/ -L /usr/local/lib -lpcre [twease@twease-computer pcre-segfault]$ valgrind ./pcre-poc ==12586== Memcheck, a memory error detector ==12586== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al. ==12586== Using Valgrind-3.5.0 and LibVEX; rerun with -h for copyright info ==12586== Command: ./pcre-poc ==12586== ==12586== Invalid write of size 4 ==12586== at 0x4C3A156: pcre_exec (pcre_exec.c:6893) ==12586== by 0x40072F: main (in /home/twease/pcre-segfault/pcre-poc) ==12586== Address 0x4e45058 is 12 bytes after a block of size 12 alloc'd ==12586== at 0x4A05E46: malloc (vg_replace_malloc.c:195) ==12586== by 0x4006C5: main (in /home/twease/pcre-segfault/pcre-poc) ==12586== ==12586== Invalid write of size 4 ==12586== at 0x4C3A163: pcre_exec (pcre_exec.c:6893) ==12586== by 0x40072F: main (in /home/twease/pcre-segfault/pcre-poc) ==12586== Address 0x4e4505c is not stack'd, malloc'd or (recently) free'd ==12586== ==12586== ==12586== HEAP SUMMARY: ==12586== in use at exit: 136 bytes in 2 blocks ==12586== total heap usage: 3 allocs, 1 frees, 196 bytes allocated ==12586== ==12586== LEAK SUMMARY: ==12586== definitely lost: 136 bytes in 2 blocks ==12586== indirectly lost: 0 bytes in 0 blocks ==12586== possibly lost: 0 bytes in 0 blocks ==12586== still reachable: 0 bytes in 0 blocks ==12586== suppressed: 0 bytes in 0 blocks ==12586== Rerun with --leak-check=full to see details of leaked memory ==12586== ==12586== For counts of detected and suppressed errors, rerun with: -v ==12586== ERROR SUMMARY: 9 errors from 2 contexts (suppressed: 6 from 6) -- Configure bugmail: http://bugs.exim.org/userprefs.cgi?tab=email -- ## List details at https://lists.exim.org/mailman/listinfo/pcre-dev
