summaryrefslogtreecommitdiffstats
path: root/generic
diff options
context:
space:
mode:
authordgp <dgp@users.sourceforge.net>2013-04-08 19:59:03 (GMT)
committerdgp <dgp@users.sourceforge.net>2013-04-08 19:59:03 (GMT)
commitb33c30f98bfe09a38ef7a2106610e2d0d0605a45 (patch)
tree66cc82c126d9de0e6ce6bc9579d76026b029826b /generic
parentba5ae0ab74c4217f0a951b0eb3edf223022af5c5 (diff)
parente62eab9118e1460d3afe28e01dc2b83bbb63194c (diff)
downloadtcl-b33c30f98bfe09a38ef7a2106610e2d0d0605a45.zip
tcl-b33c30f98bfe09a38ef7a2106610e2d0d0605a45.tar.gz
tcl-b33c30f98bfe09a38ef7a2106610e2d0d0605a45.tar.bz2
3610026 Stop crash when the number of "colors" in a regular expression
overflows a short int. Thanks to Heikki Linnakangas for the report and the patch.
Diffstat (limited to 'generic')
-rw-r--r--generic/regc_color.c7
-rw-r--r--generic/regerrs.h1
-rw-r--r--generic/regex.h1
-rw-r--r--generic/regguts.h1
4 files changed, 10 insertions, 0 deletions
diff --git a/generic/regc_color.c b/generic/regc_color.c
index ba1f668..58de004 100644
--- a/generic/regc_color.c
+++ b/generic/regc_color.c
@@ -254,7 +254,14 @@ newcolor(
* Oops, must allocate more.
*/
+ if (cm->max == MAX_COLOR) {
+ CERR(REG_ECOLORS);
+ return COLORLESS; /* too many colors */
+ }
n = cm->ncds * 2;
+ if (n < MAX_COLOR + 1) {
+ n = MAX_COLOR + 1;
+ }
if (cm->cd == cm->cdspace) {
newCd = (struct colordesc *) MALLOC(n * sizeof(struct colordesc));
if (newCd != NULL) {
diff --git a/generic/regerrs.h b/generic/regerrs.h
index 259c0cb..72548ff 100644
--- a/generic/regerrs.h
+++ b/generic/regerrs.h
@@ -17,3 +17,4 @@
{ REG_MIXED, "REG_MIXED", "character widths of regex and string differ" },
{ REG_BADOPT, "REG_BADOPT", "invalid embedded option" },
{ REG_ETOOBIG, "REG_ETOOBIG", "nfa has too many states" },
+{ REG_ECOLORS, "REG_ECOLORS", "too many colors" },
diff --git a/generic/regex.h b/generic/regex.h
index fa86092..b5dce50 100644
--- a/generic/regex.h
+++ b/generic/regex.h
@@ -278,6 +278,7 @@ typedef struct {
#define REG_MIXED 17 /* character widths of regex and string differ */
#define REG_BADOPT 18 /* invalid embedded option */
#define REG_ETOOBIG 19 /* nfa has too many states */
+#define REG_ECOLORS 20 /* too many colors */
/* two specials for debugging and testing */
#define REG_ATOI 101 /* convert error-code name to number */
#define REG_ITOA 102 /* convert error-code number to name */
diff --git a/generic/regguts.h b/generic/regguts.h
index 67e3d03..bfa7921 100644
--- a/generic/regguts.h
+++ b/generic/regguts.h
@@ -162,6 +162,7 @@
typedef short color; /* colors of characters */
typedef int pcolor; /* what color promotes to */
+#define MAX_COLOR SHRT_MAX /* max color value */
#define COLORLESS (-1) /* impossible color */
#define WHITE 0 /* default color, parent of all others */