← Back to branch summary

~ubuntu-branches/ubuntu/wily/clamav/wily-proposed

« back to all changes in this revision

Viewing changes to libclamav/regex/regcomp.c

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2015-05-05 14:14:58 UTC
  • mfrom: (0.47.16)
  • Revision ID: package-import@ubuntu.com-20150505141458-mbkr5jjfu3j9gdvd
Tags: 0.98.7+dfsg-0ubuntu1
* Updated to 0.98.7 to fix multiple issues
  - CVE-2015-2170
  - CVE-2015-2221
  - CVE-2015-2222
  - CVE-2015-2305
  - CVE-2015-2668
* Refreshed patches for 0.98.7:
  - d/p/0005-libclamav-use-libmspack.patch
  - d/p/0007-fix-ssize_t-size_t-off_t-printf-modifier.patch
  - d/p/0008-hardcode-LLVM-linker-flag-because-llvm-config-return.patch
  - d/p/0015-llvm-don-t-use-system-libs.patch
* Removed upstreamed patches:
  - d/p/0012-remove-AC_CONFIG_SRCDIR-llvm-configure-from-libclama.patch

Show diffs side-by-side

added added

removed removed

Lines of Context:
libclamav/regex/regcomp.c
157
157
        struct parse *p = &pa;
158
158
        int i;
159
159
        size_t len;
 
160
        size_t maxlen;
160
161
#ifdef REDEBUG
161
162
#       define  GOODFLAGS(f)    (f)
162
163
#else
179
180
                                                        (NC-1)*sizeof(cat_t));
180
181
        if (g == NULL)
181
182
                return(REG_ESPACE);
 
183
        /* Patch for bb11264 submitted by the Debian team:                */
 
184
        /*
 
185
         * Limit the pattern space to avoid a 32-bit overflow on buffer
 
186
         * extension.  Also avoid any signed overflow in case of conversion
 
187
         * so make the real limit based on a 31-bit overflow.
 
188
         *
 
189
         * Likely not applicable on 64-bit systems but handle the case
 
190
         * generically (who are we to stop people from using ~715MB+
 
191
         * patterns?).
 
192
         */
 
193
        maxlen = ((size_t)-1 >> 1) / sizeof(sop) * 2 / 3;
 
194
        if (len >= maxlen) {
 
195
                free((char *)g);
 
196
                return(REG_ESPACE);
 
197
        }
182
198
        p->ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */
 
199
        assert(p->ssize >= len);
 
200
 
183
201
        p->strip = (sop *)cli_calloc(p->ssize, sizeof(sop));
184
202
        p->slen = 0;
185
203
        if (p->strip == NULL) {