73 lines
2.4 KiB
Diff
73 lines
2.4 KiB
Diff
From 6ce53562bde98cec1a0595b9a21403298c8ad99d Mon Sep 17 00:00:00 2001
|
|
From: Alexander Bokovoy <abokovoy@redhat.com>
|
|
Date: Mon, 24 Mar 2025 09:48:19 +0200
|
|
Subject: [PATCH] CVE-2025-2588: return _REG_ENOSYS if no specific error was
|
|
set yet parse_regexp failed
|
|
|
|
parse_regexp() supposed to set an error on the parser state in case of a
|
|
failure. If no specific error was set, return _REG_ENOSYS to indicate a
|
|
generic failure.
|
|
|
|
Fixes: https://github.com/hercules-team/augeas/issues/671
|
|
Fixes: https://github.com/hercules-team/augeas/issues/778
|
|
Fixes: https://github.com/hercules-team/augeas/issues/852
|
|
|
|
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
|
|
---
|
|
src/fa.c | 2 ++
|
|
src/fa.h | 3 ++-
|
|
tests/fatest.c | 6 ++++++
|
|
3 files changed, 10 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/src/fa.c b/src/fa.c
|
|
index 66ac70784..4de5675b9 100644
|
|
--- a/src/fa.c
|
|
+++ b/src/fa.c
|
|
@@ -3550,6 +3550,8 @@ static struct re *parse_regexp(struct re_parse *parse) {
|
|
return re;
|
|
|
|
error:
|
|
+ if (re == NULL && parse->error == REG_NOERROR)
|
|
+ parse->error = _REG_ENOSYS;
|
|
re_unref(re);
|
|
return NULL;
|
|
}
|
|
diff --git a/src/fa.h b/src/fa.h
|
|
index 1fd754ad0..89c9b17e9 100644
|
|
--- a/src/fa.h
|
|
+++ b/src/fa.h
|
|
@@ -81,7 +81,8 @@ extern int fa_minimization_algorithm;
|
|
*
|
|
* On success, FA points to the newly allocated automaton constructed for
|
|
* RE, and the function returns REG_NOERROR. Otherwise, FA is NULL, and the
|
|
- * return value indicates the error.
|
|
+ * return value indicates the error. Special value _REG_ENOSYS indicates
|
|
+ * fa_compile() couldn't identify the syntax issue with regexp.
|
|
*
|
|
* The FA is case sensitive. Call FA_NOCASE to switch it to
|
|
* case-insensitive.
|
|
diff --git a/tests/fatest.c b/tests/fatest.c
|
|
index 0c9ca7696..6717af8f4 100644
|
|
--- a/tests/fatest.c
|
|
+++ b/tests/fatest.c
|
|
@@ -589,6 +589,7 @@ static void testExpandNoCase(CuTest *tc) {
|
|
const char *p1 = "aB";
|
|
const char *p2 = "[a-cUV]";
|
|
const char *p3 = "[^a-z]";
|
|
+ const char *wrong_regexp = "{&.{";
|
|
char *s;
|
|
size_t len;
|
|
int r;
|
|
@@ -607,6 +608,11 @@ static void testExpandNoCase(CuTest *tc) {
|
|
CuAssertIntEquals(tc, 0, r);
|
|
CuAssertStrEquals(tc, "[^A-Za-z]", s);
|
|
free(s);
|
|
+
|
|
+ /* Test that fa_expand_nocase does return _REG_ENOSYS */
|
|
+ r = fa_expand_nocase(wrong_regexp, strlen(wrong_regexp), &s, &len);
|
|
+ CuAssertIntEquals(tc, _REG_ENOSYS, r);
|
|
+ free(s);
|
|
}
|
|
|
|
static void testNoCaseComplement(CuTest *tc) {
|