diff options
| author | Brad King <brad.king@kitware.com> | 2018-06-26 15:51:44 (GMT) |
|---|---|---|
| committer | Brad King <brad.king@kitware.com> | 2018-06-26 15:54:34 (GMT) |
| commit | b29842a818ea978a85c0646cd3c2b3191b0498fc (patch) | |
| tree | 3367b225f72c3fa1d5bb8f903273a037122b36e0 /Source/LexerParser/cmListFileLexer.in.l | |
| parent | ef5e2e8a62982ebccf4883fc7a01cdb66f8ca183 (diff) | |
| download | CMake-b29842a818ea978a85c0646cd3c2b3191b0498fc.zip CMake-b29842a818ea978a85c0646cd3c2b3191b0498fc.tar.gz CMake-b29842a818ea978a85c0646cd3c2b3191b0498fc.tar.bz2 | |
ListFileLexer: Do not match null bytes in input
Extend the fix from commit v3.10.0-rc1~188^2 (ListFileLexer: fix
heap-buffer-overflow on malicious input, 2017-08-26) to apply to all
lexer token matches. Replace all `.` with `[^\0\n]`. Update all
`[^...]` match expressions to not match `\0`.
We cannot safely process null bytes in strings.
Fixes: #18124
Diffstat (limited to 'Source/LexerParser/cmListFileLexer.in.l')
| -rw-r--r-- | Source/LexerParser/cmListFileLexer.in.l | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/Source/LexerParser/cmListFileLexer.in.l b/Source/LexerParser/cmListFileLexer.in.l index f2fd538..23c7e49 100644 --- a/Source/LexerParser/cmListFileLexer.in.l +++ b/Source/LexerParser/cmListFileLexer.in.l @@ -74,7 +74,7 @@ static void cmListFileLexerDestroy(cmListFileLexer* lexer); %x COMMENT MAKEVAR \$\([A-Za-z0-9_]*\) -UNQUOTED ([^ \0\t\r\n\(\)#\\\"[=]|\\.) +UNQUOTED ([^ \0\t\r\n\(\)#\\\"[=]|\\[^\0\n]) LEGACY {MAKEVAR}|{UNQUOTED}|\"({MAKEVAR}|{UNQUOTED}|[ \t[=])*\" %% @@ -156,7 +156,7 @@ LEGACY {MAKEVAR}|{UNQUOTED}|\"({MAKEVAR}|{UNQUOTED}|[ \t[=])*\" return 1; } -<BRACKET>([^]\n])+ { +<BRACKET>([^]\0\n])+ { cmListFileLexerAppend(lexer, yytext, yyleng); lexer->column += yyleng; } @@ -208,7 +208,7 @@ LEGACY {MAKEVAR}|{UNQUOTED}|\"({MAKEVAR}|{UNQUOTED}|[ \t[=])*\" BEGIN(STRING); } -<STRING>([^\\\n\"]|\\.)+ { +<STRING>([^\\\0\n\"]|\\[^\0\n])+ { cmListFileLexerAppend(lexer, yytext, yyleng); lexer->column += yyleng; } |