diff options
| author | dgp <dgp@users.sourceforge.net> | 2013-04-08 19:59:03 (GMT) |
|---|---|---|
| committer | dgp <dgp@users.sourceforge.net> | 2013-04-08 19:59:03 (GMT) |
| commit | b33c30f98bfe09a38ef7a2106610e2d0d0605a45 (patch) | |
| tree | 66cc82c126d9de0e6ce6bc9579d76026b029826b /generic | |
| parent | ba5ae0ab74c4217f0a951b0eb3edf223022af5c5 (diff) | |
| parent | e62eab9118e1460d3afe28e01dc2b83bbb63194c (diff) | |
| download | tcl-b33c30f98bfe09a38ef7a2106610e2d0d0605a45.zip tcl-b33c30f98bfe09a38ef7a2106610e2d0d0605a45.tar.gz tcl-b33c30f98bfe09a38ef7a2106610e2d0d0605a45.tar.bz2 | |
3610026 Stop crash when the number of "colors" in a regular expression
overflows a short int. Thanks to Heikki Linnakangas for the report and
the patch.
Diffstat (limited to 'generic')
| -rw-r--r-- | generic/regc_color.c | 7 | ||||
| -rw-r--r-- | generic/regerrs.h | 1 | ||||
| -rw-r--r-- | generic/regex.h | 1 | ||||
| -rw-r--r-- | generic/regguts.h | 1 |
4 files changed, 10 insertions, 0 deletions
diff --git a/generic/regc_color.c b/generic/regc_color.c index ba1f668..58de004 100644 --- a/generic/regc_color.c +++ b/generic/regc_color.c @@ -254,7 +254,14 @@ newcolor( * Oops, must allocate more. */ + if (cm->max == MAX_COLOR) { + CERR(REG_ECOLORS); + return COLORLESS; /* too many colors */ + } n = cm->ncds * 2; + if (n < MAX_COLOR + 1) { + n = MAX_COLOR + 1; + } if (cm->cd == cm->cdspace) { newCd = (struct colordesc *) MALLOC(n * sizeof(struct colordesc)); if (newCd != NULL) { diff --git a/generic/regerrs.h b/generic/regerrs.h index 259c0cb..72548ff 100644 --- a/generic/regerrs.h +++ b/generic/regerrs.h @@ -17,3 +17,4 @@ { REG_MIXED, "REG_MIXED", "character widths of regex and string differ" }, { REG_BADOPT, "REG_BADOPT", "invalid embedded option" }, { REG_ETOOBIG, "REG_ETOOBIG", "nfa has too many states" }, +{ REG_ECOLORS, "REG_ECOLORS", "too many colors" }, diff --git a/generic/regex.h b/generic/regex.h index fa86092..b5dce50 100644 --- a/generic/regex.h +++ b/generic/regex.h @@ -278,6 +278,7 @@ typedef struct { #define REG_MIXED 17 /* character widths of regex and string differ */ #define REG_BADOPT 18 /* invalid embedded option */ #define REG_ETOOBIG 19 /* nfa has too many states */ +#define REG_ECOLORS 20 /* too many colors */ /* two specials for debugging and testing */ #define REG_ATOI 101 /* convert error-code name to number */ #define REG_ITOA 102 /* convert error-code number to name */ diff --git a/generic/regguts.h b/generic/regguts.h index 67e3d03..bfa7921 100644 --- a/generic/regguts.h +++ b/generic/regguts.h @@ -162,6 +162,7 @@ typedef short color; /* colors of characters */ typedef int pcolor; /* what color promotes to */ +#define MAX_COLOR SHRT_MAX /* max color value */ #define COLORLESS (-1) /* impossible color */ #define WHITE 0 /* default color, parent of all others */ |