mirror of
https://github.com/MariaDB/server.git
synced 2025-01-31 02:51:44 +01:00
957aefdc8f
DESCRIPTION =========== Buffer overflow is reported in Regex library. This can be triggered when the data corresponding to argv[1] is >= 512 bytes resutling in abnormal behaviour. ANALYSIS ======== Its a straight forward case of SEGFAULT where the target buffer is smaller than the source string to be copied. A simple pre-copy validation should do. FIX === A check is added before doing strcpy() to ensure that the target buffer is big enough to hold the to-be copied data. If the check fails, the program aborts. |
||
|---|---|---|
| .. | ||
| cclass.h | ||
| CHANGES | ||
| CMakeLists.txt | ||
| cname.h | ||
| COPYRIGHT | ||
| debug.c | ||
| debug.ih | ||
| engine.c | ||
| engine.ih | ||
| main.c | ||
| main.ih | ||
| my_regex.h | ||
| README | ||
| regcomp.c | ||
| regcomp.ih | ||
| regerror.c | ||
| regerror.ih | ||
| regex.3 | ||
| regex.7 | ||
| regex2.h | ||
| regexec.c | ||
| regexp.c | ||
| regfree.c | ||
| reginit.c | ||
| split.c | ||
| tests | ||
| utils.h | ||
| WHATSNEW | ||
alpha3.4 release.
Thu Mar 17 23:17:18 EST 1994
henry@zoo.toronto.edu
See WHATSNEW for change listing.
installation notes:
--------
Read the comments at the beginning of Makefile before running.
Utils.h contains some things that just might have to be modified on
some systems, as well as a nested include (ugh) of <assert.h>.
The "fake" directory contains quick-and-dirty fakes for some header
files and routines that old systems may not have. Note also that
-DUSEBCOPY will make utils.h substitute bcopy() for memmove().
After that, "make r" will build regcomp.o, regexec.o, regfree.o,
and regerror.o (the actual routines), bundle them together into a test
program, and run regression tests on them. No output is good output.
"make lib" builds just the .o files for the actual routines (when
you're happy with testing and have adjusted CFLAGS for production),
and puts them together into libregex.a. You can pick up either the
library or *.o ("make lib" makes sure there are no other .o files left
around to confuse things).
Main.c, debug.c, split.c are used for regression testing but are not part
of the RE routines themselves.
Regex.h goes in /usr/include. All other .h files are internal only.
--------