https://bugs.exim.org/show_bug.cgi?id=2007
Bug ID: 2007
Summary: Stack Overflow in op_recurse_ovecsave()
Product: PCRE
Version: N/A
Hardware: x86-64
OS: Linux
Status: NEW
Severity: bug
Priority: medium
Component: Code
Assignee: p...@hermes.cam.ac.uk
Reporter: fumfi....@gmail.com
CC: pcre-dev@exim.org
Created attachment 966
--> https://bugs.exim.org/attachment.cgi?id=966&action=edit
POC to trigger Stack Overflow (pcre2test)
Affected:
- PCRE2 version 10.23-RC1 2016-08-01 (SVN revision: 634)
To reproduce the problem (pcre2test):
pcre2test pcre2_stack_overflow_op_recurse_ovecsave /dev/null
ASAN output:
==8375==ERROR: AddressSanitizer: stack-overflow on address 0x7fffca46a9a8 (pc
0x0000004a1e85 bp 0x7fffca46b210 sp 0x7fffca46a9b0 T0)
#0 0x4a1e84 in __asan_memcpy
/home/development/llvm/3.9.0/final/llvm.src/projects/compiler-rt/lib/asan/asan_interceptors.cc:413:3
#1 0x7ff29234733a in op_recurse_ovecsave XYZ/pcre2/src/pcre2_match.c:480:1
#2 0x7ff292302390 in match XYZ/pcre2/src/pcre2_match.c:1835:15
#3 0x7ff29232680c in match XYZ/pcre2/src/pcre2_match.c:1107:7
#4 0x7ff2922f75c2 in match XYZ/pcre2/src/pcre2_match.c:1948:5
#5 0x7ff292339279 in match XYZ/pcre2/src/pcre2_match.c:1017:9
#6 0x7ff29234778f in op_recurse_ovecsave XYZ/pcre2/src/pcre2_match.c:488:9
####################### === SNIP! === #######################
#247 0x7ff292302390 in match XYZ/pcre2/src/pcre2_match.c:1835:15
#248 0x7ff29232680c in match XYZ/pcre2/src/pcre2_match.c:1107:7
#249 0x7ff2922f75c2 in match XYZ/pcre2/src/pcre2_match.c:1948:5
#250 0x7ff292339279 in match XYZ/pcre2/src/pcre2_match.c:1017:9
#251 0x7ff29234778f in op_recurse_ovecsave
XYZ/pcre2/src/pcre2_match.c:488:9
SUMMARY: AddressSanitizer: stack-overflow
/home/development/llvm/3.9.0/final/llvm.src/projects/compiler-rt/lib/asan/asan_interceptors.cc:413:3
in __asan_memcpy
==8375==ABORTING
--
You are receiving this mail because:
You are on the CC list for the bug.
--
## List details at https://lists.exim.org/mailman/listinfo/pcre-dev
