diff options
| -rw-r--r-- | debian/changelog | 8 | ||||
| -rw-r--r-- | debian/patches/CVE-2017-6004.patch | 19 | ||||
| -rw-r--r-- | debian/patches/series | 1 | ||||
| -rw-r--r-- | pcre_jit_compile.c | 2 |
4 files changed, 29 insertions, 1 deletions
diff --git a/debian/changelog b/debian/changelog index 4922e77..0c0a5dc 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,11 @@ +pcre3 (2:8.39-2.1) unstable; urgency=high + + * Non-maintainer upload. + * CVE-2017-6004: crafted regular expression may cause denial of service + (Closes: #855405) + + -- Salvatore Bonaccorso <carnil@debian.org> Fri, 17 Feb 2017 15:56:09 +0100 + pcre3 (2:8.39-2) unstable; urgency=low * Update symbols file to reflect compilation with gcc6 (Closes: #811969) diff --git a/debian/patches/CVE-2017-6004.patch b/debian/patches/CVE-2017-6004.patch new file mode 100644 index 0000000..afec3f8 --- /dev/null +++ b/debian/patches/CVE-2017-6004.patch @@ -0,0 +1,19 @@ +Description: CVE-2017-6004: crafted regular expression may cause denial of service +Origin: upstream, https://vcs.pcre.org/pcre/code/trunk/pcre_jit_compile.c?r1=1676&r2=1680&view=patch +Bug: https://bugs.exim.org/show_bug.cgi?id=2035 +Bug-Debian: https://bugs.debian.org/855405 +Forwarded: not-needed +Author: Salvatore Bonaccorso <carnil@debian.org> +Last-Update: 2017-02-17 + +--- a/pcre_jit_compile.c ++++ b/pcre_jit_compile.c +@@ -8111,7 +8111,7 @@ if (opcode == OP_COND || opcode == OP_SC + + if (*matchingpath == OP_FAIL) + stacksize = 0; +- if (*matchingpath == OP_RREF) ++ else if (*matchingpath == OP_RREF) + { + stacksize = GET2(matchingpath, 1); + if (common->currententry == NULL) diff --git a/debian/patches/series b/debian/patches/series index bdf74b5..d0ac423 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -5,3 +5,4 @@ pcregrep.1-patch soname.patch no_jit_x32_powerpcspe.patch Disable_JIT_on_sparc64.patch +CVE-2017-6004.patch diff --git a/pcre_jit_compile.c b/pcre_jit_compile.c index 4f15a27..70f07c2 100644 --- a/pcre_jit_compile.c +++ b/pcre_jit_compile.c @@ -8111,7 +8111,7 @@ if (opcode == OP_COND || opcode == OP_SCOND) if (*matchingpath == OP_FAIL) stacksize = 0; - if (*matchingpath == OP_RREF) + else if (*matchingpath == OP_RREF) { stacksize = GET2(matchingpath, 1); if (common->currententry == NULL) |