[Privoxy-commits] [privoxy] 01/26: pcrs: Properly deal with too many submatches

[User Git]

This is an automated email from the git hooks/post-receive script.

git pushed a commit to branch master
in repository privoxy.

commit e8f6884f9750941d9af6f90ffff6f72158c6514e
Author: Fabian Keil <fk at fabiankeil.de>
AuthorDate: Wed Sep 2 11:10:19 2026 +0200

    pcrs: Properly deal with too many submatches
    
    Previously on some platforms a pcrs job with lots of submatches
    would result in crashes due to memory corruption.
    
    On affected plaforms this could be remotely triggered after adding
    and enabling a custom dynamic filter with a variable like $path in
    the pattern part of the pcrs job and requesting an URL with lots
    of '()' in the path.
    
    While variables like $path that contain characters under the client's
    control should not be used in the pattern part anyway, this is currently
    not explicitly documented and should not result in memory corruption.
    
    Reported by Eli Fulkerson. OVE-20260829-0001.
---
 pcrs.c | 8 ++++++++
 pcrs.h | 1 +
 2 files changed, 9 insertions(+)

diff --git a/pcrs.c b/pcrs.c
index cfaf8571..5ff35f2a 100644
--- a/pcrs.c
+++ b/pcrs.c
@@ -110,6 +110,7 @@ const char *pcrs_strerror(const int error)
          case PCRS_WARN_BADREF:        return "(pcrs:) Backreference out of range";
          case PCRS_WARN_TRUNCATION:
             return "(pcrs:) At least one variable was too big and has been truncated before compilation";
+         case PCRS_TOO_MANY_SUBMATCHES: return "(pcrs:) Submatch limit reached";
 
          default:
             pcre2_get_error_message(error, (PCRE2_UCHAR8*)buf, sizeof(buf));
@@ -835,6 +836,13 @@ int pcrs_execute(pcrs_job *job, const char *subject, size_t subject_length, char
    while ((submatches = pcre2_match(job->pattern, (const unsigned char *)subject,
                            subject_length, (size_t)offset, 0, pcre2_matches, NULL)) > 0)
    {
+      if (submatches >= PCRS_MAX_SUBMATCHES)
+      {
+         free(matches);
+         pcre2_match_data_free(pcre2_matches);
+
+         return(PCRS_TOO_MANY_SUBMATCHES);
+      }
       job->flags |= PCRS_SUCCESS;
       matches[i].submatches = submatches;
 
diff --git a/pcrs.h b/pcrs.h
index 507d6970..7ebb7fc1 100644
--- a/pcrs.h
+++ b/pcrs.h
@@ -72,6 +72,7 @@
 #define PCRS_WARN_BADREF         -304      /* Backreference out of range */
 #define PCRS_WARN_TRUNCATION     -305      /* At least one pcrs variable was too big,
                                             * only the first part was used. */
+#define PCRS_TOO_MANY_SUBMATCHES -306      /* PCRS_MAX_SUBMATCHES reached. */
 
 /* Flags */
 #define PCRS_GLOBAL          0x08000000u      /* Job should be applied globally, as with perl's g option */

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.