1berry/ruby
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix regex from regex memory corruption

Browse Source 
before this change, creating a regex from a regex with a named capture, Regexp.new(/(?<name>)/), causes memory to be shared between the two named capture groups which can cause a segfault if the original is GCed.
This commit is contained in:
Adam Hess 2023-11-01 00:01:55 -07:00 committed by Peter Zhu
parent b4bf8c9ee2
commit 05cde4155c
1 changed files with 26 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
regparse.c
View File

@ -275,7 +275,7 @@ onig_strcpy(UChar* dest, const UChar* src, const UChar* end)
#ifdef USE_NAMED_GROUP #ifdef USE_NAMED_GROUP
static UChar* static UChar*
strdup_with_null(OnigEncoding enc, UChar* s, UChar* end) strdup_with_null(OnigEncoding enc, const UChar* s, const UChar* end)
{ {
ptrdiff_t slen; ptrdiff_t slen;
int term_len, i; int term_len, i;
@ -551,12 +551,36 @@ onig_names_free(regex_t* reg)
return 0; return 0;
} }
static int
copy_named_captures_iter(const OnigUChar *name, const OnigUChar *name_end,
int back_num, int *back_refs, OnigRegex regex, void *arg)
{
NameTable *copy_table = (NameTable *)arg;
NameEntry *entry_copy = (NameEntry* )xmalloc(sizeof(NameEntry));
entry_copy->name_len = name_end - name;
entry_copy->back_num = back_num;
entry_copy->back_alloc = back_num;
entry_copy->back_ref1 = back_refs[0];
entry_copy->back_refs = xmalloc(back_num * (sizeof(int*)));
for (int i = 0; i < back_num; i++) {
entry_copy->back_refs[i] = back_refs[i];
}
UChar *new_name = strdup_with_null(regex->enc, name, name_end);
entry_copy->name = new_name;
onig_st_insert_strend(copy_table, new_name, (new_name + entry_copy->name_len), (hash_data_type)entry_copy);
return ST_CONTINUE;
}
extern int extern int
onig_names_copy(regex_t* reg, regex_t* oreg) onig_names_copy(regex_t* reg, regex_t* oreg)
{ {
NameTable* table = oreg->name_table; NameTable* table = oreg->name_table;
if (table) { if (table) {
NameTable* t = st_copy(table); NameTable * t = onig_st_init_strend_table_with_size(onig_number_of_names(oreg));
onig_foreach_name(oreg, copy_named_captures_iter, (void*)t);
reg->name_table = t; reg->name_table = t;
} }
return 0; return 0;