Skip to content

libclamav: Malformed regexes result in misleading memory error messages. #1635

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+17 −16
Open

libclamav: Malformed regexes result in misleading memory error messages. #1635

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions libclamav/regex_list.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -816,6 +816,10 @@ static cl_error_t add_pattern_suffix(void *cbdata, const char *suffix, size_t su

if (CL_SUCCESS != ret) {
cli_hashtab_delete(&matcher->suffix_hash, suffix, suffix_len);
/* Check if there is anything to shrink back to */
if (n == 0) {
goto done;
}
/*shrink the size back to what it was.*/
CLI_MAX_REALLOC_OR_GOTO_DONE(matcher->suffix_regexes, n * sizeof(*matcher->suffix_regexes));
} else {
Expand Down
29 changes: 13 additions & 16 deletions libclamav/regex_suffix.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -394,9 +394,7 @@ static cl_error_t build_suffixtree_ascend(struct node *n, struct text_buffer *bu
cnt++;
if (cnt > 16) {
textbuffer_putc(buf, '\0');
if (cb(cbdata, buf->data, buf->pos - 1, regex) != CL_SUCCESS)
return CL_EMEM;
return CL_SUCCESS;
return cb(cbdata, buf->data, buf->pos - 1, regex);
}
/* handle small classes by expanding */
for (i = 0; i < 255; i++) {
Expand All @@ -412,11 +410,9 @@ static cl_error_t build_suffixtree_ascend(struct node *n, struct text_buffer *bu
return 0;
case concat:
if (prev != n->u.children.left) {
if (build_suffixtree_descend(n->u.children.left, buf, cb, cbdata, regex) != CL_SUCCESS)
return CL_EMEM;
return build_suffixtree_descend(n->u.children.left, buf, cb, cbdata, regex);
/* we're done here, descend will call
* ascend if needed */
return CL_SUCCESS;
} else {
n = n->parent;
}
Expand All @@ -438,6 +434,7 @@ static cl_error_t build_suffixtree_ascend(struct node *n, struct text_buffer *bu
static cl_error_t build_suffixtree_descend(struct node *n, struct text_buffer *buf, suffix_callback cb, void *cbdata, struct regex_list *regex)
{
size_t pos;
cl_error_t ret = CL_SUCCESS;
while (n && n->type == concat) {
n = n->u.children.right;
}
Expand All @@ -449,23 +446,23 @@ static cl_error_t build_suffixtree_descend(struct node *n, struct text_buffer *b
case alternate:
/* save pos as restart point */
pos = buf->pos;
if (build_suffixtree_descend(n->u.children.left, buf, cb, cbdata, regex) != CL_SUCCESS)
return CL_EMEM;
if ((ret = build_suffixtree_descend(n->u.children.left, buf, cb, cbdata, regex)) != CL_SUCCESS) {
return ret;
}
buf->pos = pos;
if (build_suffixtree_descend(n->u.children.right, buf, cb, cbdata, regex) != CL_SUCCESS)
return CL_EMEM;
if ((ret = build_suffixtree_descend(n->u.children.right, buf, cb, cbdata, regex)) != CL_SUCCESS) {
return ret;
}
buf->pos = pos;
break;
case optional:
textbuffer_putc(buf, '\0');
if (cb(cbdata, buf->data, buf->pos - 1, regex) != CL_SUCCESS)
return CL_EMEM;
return CL_SUCCESS;
if ((ret = cb(cbdata, buf->data, buf->pos - 1, regex)) != CL_SUCCESS) {
return ret;
}
case leaf:
case leaf_class:
if (build_suffixtree_ascend(n, buf, NULL, cb, cbdata, regex) != CL_SUCCESS)
return CL_EMEM;
return CL_SUCCESS;
return build_suffixtree_ascend(n, buf, NULL, cb, cbdata, regex);
default:
break;
}
Expand Down
Loading