7da5705
From 83ed574998fe7b844b98ab7cd56291068feb9e31 Mon Sep 17 00:00:00 2001
7da5705
From: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
7da5705
Date: Sat, 16 May 2015 11:05:40 +0000
7da5705
Subject: [PATCH] Fix named forward reference to duplicate group number
7da5705
 overflow bug.
7da5705
MIME-Version: 1.0
7da5705
Content-Type: text/plain; charset=UTF-8
7da5705
Content-Transfer-Encoding: 8bit
7da5705
7da5705
Port to 8.37:
7da5705
7da5705
commit 2fa78aa4e42bcebf2d616c4ee89c012f29dc3447
7da5705
Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
7da5705
Date:   Sat May 16 11:05:40 2015 +0000
7da5705
7da5705
    Fix named forward reference to duplicate group number overflow bug.
7da5705
7da5705
    git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1559 2f5784b3-3f2a-0410-8824-cb99058d5e15
7da5705
7da5705
Signed-off-by: Petr Písař <ppisar@redhat.com>
7da5705
---
7da5705
 pcre_compile.c       | 24 ++++++++++++++++--------
7da5705
 testdata/testinput1  |  3 +++
7da5705
 testdata/testoutput1 |  5 +++++
7da5705
 3 files changed, 24 insertions(+), 8 deletions(-)
7da5705
7da5705
diff --git a/pcre_compile.c b/pcre_compile.c
7da5705
index b66b1f6..8b4aaef 100644
7da5705
--- a/pcre_compile.c
7da5705
+++ b/pcre_compile.c
7da5705
@@ -7183,15 +7183,15 @@ for (;; ptr++)
7da5705
               open_capitem *oc;
7da5705
               recno = ng->number;
7da5705
               if (is_recurse) break;
7da5705
-              for (oc = cd->open_caps; oc != NULL; oc = oc->next)         
7da5705
-                {          
7da5705
-                if (oc->number == recno)                                     
7da5705
-                  {               
7da5705
-                  oc->flag = TRUE;                                      
7da5705
+              for (oc = cd->open_caps; oc != NULL; oc = oc->next)
7da5705
+                {
7da5705
+                if (oc->number == recno)
7da5705
+                  {
7da5705
+                  oc->flag = TRUE;
7da5705
                   break;
7da5705
-                  }                                                         
7da5705
-                }                          
7da5705
-              }    
7da5705
+                  }
7da5705
+                }
7da5705
+              }
7da5705
             }
7da5705
 
7da5705
           /* Count named back references. */
7da5705
@@ -7203,6 +7203,14 @@ for (;; ptr++)
7da5705
           16-bit data item. */
7da5705
 
7da5705
           *lengthptr += IMM2_SIZE;
7da5705
+
7da5705
+          /* If this is a forward reference and we are within a (?|...) group,
7da5705
+          the reference may end up as the number of a group which we are
7da5705
+          currently inside, that is, it could be a recursive reference. In the
7da5705
+          real compile this will be picked up and the reference wrapped with
7da5705
+          OP_ONCE to make it atomic, so we must space in case this occurs. */
7da5705
+
7da5705
+          if (recno == 0) *lengthptr += 2 + 2*LINK_SIZE;
7da5705
           }
7da5705
 
7da5705
         /* In the real compile, search the name table. We check the name
7da5705
diff --git a/testdata/testinput1 b/testdata/testinput1
7da5705
index 73c2f4d..8379ce0 100644
7da5705
--- a/testdata/testinput1
7da5705
+++ b/testdata/testinput1
7da5705
@@ -5730,4 +5730,7 @@ AbcdCBefgBhiBqz
7da5705
 "(?1)(?#?'){8}(a)"
7da5705
     baaaaaaaaac
7da5705
 
7da5705
+"(?|(\k'Pm')|(?'Pm'))"
7da5705
+    abcd
7da5705
+
7da5705
 /-- End of testinput1 --/
7da5705
diff --git a/testdata/testoutput1 b/testdata/testoutput1
7da5705
index 0a53fd0..e852ab9 100644
7da5705
--- a/testdata/testoutput1
7da5705
+++ b/testdata/testoutput1
7da5705
@@ -9429,4 +9429,9 @@ No match
7da5705
  0: aaaaaaaaa
7da5705
  1: a
7da5705
 
7da5705
+"(?|(\k'Pm')|(?'Pm'))"
7da5705
+    abcd
7da5705
+ 0: 
7da5705
+ 1: 
7da5705
+
7da5705
 /-- End of testinput1 --/
7da5705
-- 
7da5705
2.4.3
7da5705