diff options
| author | Tom Lane <tgl@sss.pgh.pa.us> | 2015-10-02 14:51:59 -0400 |
|---|---|---|
| committer | Tom Lane <tgl@sss.pgh.pa.us> | 2015-10-02 14:51:59 -0400 |
| commit | e7de1bc0979ad81789864e6c2d346a5c16f28ad2 (patch) | |
| tree | 9d5bd0ab51b56b508a232b3df74d663fe4fe0bcd /src/backend/regex/regexec.c | |
| parent | 6301549550b7eab46435dd059a9cb9b54dd67033 (diff) | |
| download | postgresql-e7de1bc0979ad81789864e6c2d346a5c16f28ad2.tar.gz postgresql-e7de1bc0979ad81789864e6c2d346a5c16f28ad2.zip | |
Add recursion depth protections to regular expression matching.
Some of the functions in regex compilation and execution recurse, and
therefore could in principle be driven to stack overflow. The Tcl crew
has seen this happen in practice in duptraverse(), though their fix was
to put in a hard-wired limit on the number of recursive levels, which is
not too appetizing --- fortunately, we have enough infrastructure to check
the actually available stack. Greg Stark has also seen it in other places
while fuzz testing on a machine with limited stack space. Let's put guards
in to prevent crashes in all these places.
Since the regex code would leak memory if we simply threw elog(ERROR),
we have to introduce an API that checks for stack depth without throwing
such an error. Fortunately that's not difficult.
Diffstat (limited to 'src/backend/regex/regexec.c')
| -rw-r--r-- | src/backend/regex/regexec.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/backend/regex/regexec.c b/src/backend/regex/regexec.c index 0f14d5ba01e..848b9df3d28 100644 --- a/src/backend/regex/regexec.c +++ b/src/backend/regex/regexec.c @@ -749,6 +749,9 @@ cdissect(struct vars * v, /* handy place to check for operation cancel */ if (CANCEL_REQUESTED(v->re)) return REG_CANCEL; + /* ... and stack overrun */ + if (STACK_TOO_DEEP(v->re)) + return REG_ETOOBIG; switch (t->op) { |