| | @@ -6996,11 +6996,11 @@ |
| 6996 | 6996 | ** The following regular expression syntax is supported: |
| 6997 | 6997 | ** |
| 6998 | 6998 | ** X* zero or more occurrences of X |
| 6999 | 6999 | ** X+ one or more occurrences of X |
| 7000 | 7000 | ** X? zero or one occurrences of X |
| 7001 | | -** X{p,q} between p and q occurrences of X, 0 <= p,q <= 999 |
| 7001 | +** X{p,q} between p and q occurrences of X |
| 7002 | 7002 | ** (X) match X |
| 7003 | 7003 | ** X|Y X or Y |
| 7004 | 7004 | ** ^X X occurring at the beginning of the string |
| 7005 | 7005 | ** X$ X occurring at the end of the string |
| 7006 | 7006 | ** . Match any single character |
| | @@ -7026,20 +7026,20 @@ |
| 7026 | 7026 | ** exhibits exponential behavior. Note that the X{p,q} operator expands |
| 7027 | 7027 | ** to p copies of X following by q-p copies of X? and that the size of the |
| 7028 | 7028 | ** regular expression in the O(N*M) performance bound is computed after |
| 7029 | 7029 | ** this expansion. |
| 7030 | 7030 | ** |
| 7031 | | -** To help prevent DoS attacks, the values of p and q in the "{p,q}" syntax |
| 7032 | | -** are limited to SQLITE_MAX_REGEXP_REPEAT, default 999. |
| 7031 | +** To help prevent DoS attacks, the size of the NFA is limit to |
| 7032 | +** SQLITE_MAX_REGEXP states, default 9999. |
| 7033 | 7033 | */ |
| 7034 | 7034 | #include <string.h> |
| 7035 | 7035 | #include <stdlib.h> |
| 7036 | 7036 | /* #include "sqlite3ext.h" */ |
| 7037 | 7037 | SQLITE_EXTENSION_INIT1 |
| 7038 | 7038 | |
| 7039 | | -#ifndef SQLITE_MAX_REGEXP_REPEAT |
| 7040 | | -# define SQLITE_MAX_REGEXP_REPEAT 999 |
| 7039 | +#ifndef SQLITE_MAX_REGEXP |
| 7040 | +# define SQLITE_MAX_REGEXP 9999 |
| 7041 | 7041 | #endif |
| 7042 | 7042 | |
| 7043 | 7043 | /* |
| 7044 | 7044 | ** The following #defines change the names of some functions implemented in |
| 7045 | 7045 | ** this file to prevent name collisions with C-library functions of the |
| | @@ -7135,10 +7135,11 @@ |
| 7135 | 7135 | unsigned (*xNextChar)(ReInput*); /* Next character function */ |
| 7136 | 7136 | unsigned char zInit[12]; /* Initial text to match */ |
| 7137 | 7137 | int nInit; /* Number of bytes in zInit */ |
| 7138 | 7138 | unsigned nState; /* Number of entries in aOp[] and aArg[] */ |
| 7139 | 7139 | unsigned nAlloc; /* Slots allocated for aOp[] and aArg[] */ |
| 7140 | + unsigned mxAlloc; /* Complexity limit */ |
| 7140 | 7141 | }; |
| 7141 | 7142 | |
| 7142 | 7143 | /* Add a state to the given state set if it is not already there */ |
| 7143 | 7144 | static void re_add_state(ReStateSet *pSet, int newState){ |
| 7144 | 7145 | unsigned i; |
| | @@ -7352,15 +7353,16 @@ |
| 7352 | 7353 | /* Resize the opcode and argument arrays for an RE under construction. |
| 7353 | 7354 | */ |
| 7354 | 7355 | static int re_resize(ReCompiled *p, int N){ |
| 7355 | 7356 | char *aOp; |
| 7356 | 7357 | int *aArg; |
| 7358 | + if( N>p->mxAlloc ){ p->zErr = "REGEXP pattern too big"; return 1; } |
| 7357 | 7359 | aOp = sqlite3_realloc64(p->aOp, N*sizeof(p->aOp[0])); |
| 7358 | | - if( aOp==0 ) return 1; |
| 7360 | + if( aOp==0 ){ p->zErr = "out of memory"; return 1; } |
| 7359 | 7361 | p->aOp = aOp; |
| 7360 | 7362 | aArg = sqlite3_realloc64(p->aArg, N*sizeof(p->aArg[0])); |
| 7361 | | - if( aArg==0 ) return 1; |
| 7363 | + if( aArg==0 ){ p->zErr = "out of memory"; return 1; } |
| 7362 | 7364 | p->aArg = aArg; |
| 7363 | 7365 | p->nAlloc = N; |
| 7364 | 7366 | return 0; |
| 7365 | 7367 | } |
| 7366 | 7368 | |
| | @@ -7545,20 +7547,20 @@ |
| 7545 | 7547 | unsigned int m = 0, n = 0; |
| 7546 | 7548 | unsigned int sz, j; |
| 7547 | 7549 | if( iPrev<0 ) return "'{m,n}' without operand"; |
| 7548 | 7550 | while( (c=rePeek(p))>='0' && c<='9' ){ |
| 7549 | 7551 | m = m*10 + c - '0'; |
| 7550 | | - if( m>SQLITE_MAX_REGEXP_REPEAT ) return "integer too large"; |
| 7552 | + if( m*2>p->mxAlloc ) return "REGEXP pattern too big"; |
| 7551 | 7553 | p->sIn.i++; |
| 7552 | 7554 | } |
| 7553 | 7555 | n = m; |
| 7554 | 7556 | if( c==',' ){ |
| 7555 | 7557 | p->sIn.i++; |
| 7556 | 7558 | n = 0; |
| 7557 | 7559 | while( (c=rePeek(p))>='0' && c<='9' ){ |
| 7558 | 7560 | n = n*10 + c-'0'; |
| 7559 | | - if( n>SQLITE_MAX_REGEXP_REPEAT ) return "integer too large"; |
| 7561 | + if( n*2>p->mxAlloc ) return "REGEXP pattern too big"; |
| 7560 | 7562 | p->sIn.i++; |
| 7561 | 7563 | } |
| 7562 | 7564 | } |
| 7563 | 7565 | if( c!='}' ) return "unmatched '{'"; |
| 7564 | 7566 | if( n<m ) return "n less than m in '{m,n}'"; |
| | @@ -7575,11 +7577,11 @@ |
| 7575 | 7577 | for(j=m; j<n; j++){ |
| 7576 | 7578 | re_append(p, RE_OP_FORK, sz+1); |
| 7577 | 7579 | re_copy(p, iPrev, sz); |
| 7578 | 7580 | } |
| 7579 | 7581 | if( n==0 && m>0 ){ |
| 7580 | | - re_append(p, RE_OP_FORK, -sz); |
| 7582 | + re_append(p, RE_OP_FORK, -(int)sz); |
| 7581 | 7583 | } |
| 7582 | 7584 | break; |
| 7583 | 7585 | } |
| 7584 | 7586 | case '[': { |
| 7585 | 7587 | unsigned int iFirst = p->nState; |
| | @@ -7656,11 +7658,16 @@ |
| 7656 | 7658 | ** Compile a textual regular expression in zIn[] into a compiled regular |
| 7657 | 7659 | ** expression suitable for us by re_match() and return a pointer to the |
| 7658 | 7660 | ** compiled regular expression in *ppRe. Return NULL on success or an |
| 7659 | 7661 | ** error message if something goes wrong. |
| 7660 | 7662 | */ |
| 7661 | | -static const char *re_compile(ReCompiled **ppRe, const char *zIn, int noCase){ |
| 7663 | +static const char *re_compile( |
| 7664 | + ReCompiled **ppRe, /* OUT: write compiled NFA here */ |
| 7665 | + const char *zIn, /* Input regular expression */ |
| 7666 | + int mxRe, /* Complexity limit */ |
| 7667 | + int noCase /* True for caseless comparisons */ |
| 7668 | +){ |
| 7662 | 7669 | ReCompiled *pRe; |
| 7663 | 7670 | const char *zErr; |
| 7664 | 7671 | int i, j; |
| 7665 | 7672 | |
| 7666 | 7673 | *ppRe = 0; |
| | @@ -7668,13 +7675,15 @@ |
| 7668 | 7675 | if( pRe==0 ){ |
| 7669 | 7676 | return "out of memory"; |
| 7670 | 7677 | } |
| 7671 | 7678 | memset(pRe, 0, sizeof(*pRe)); |
| 7672 | 7679 | pRe->xNextChar = noCase ? re_next_char_nocase : re_next_char; |
| 7680 | + pRe->mxAlloc = mxRe; |
| 7673 | 7681 | if( re_resize(pRe, 30) ){ |
| 7682 | + zErr = pRe->zErr; |
| 7674 | 7683 | re_free(pRe); |
| 7675 | | - return "out of memory"; |
| 7684 | + return zErr; |
| 7676 | 7685 | } |
| 7677 | 7686 | if( zIn[0]=='^' ){ |
| 7678 | 7687 | zIn++; |
| 7679 | 7688 | }else{ |
| 7680 | 7689 | re_append(pRe, RE_OP_ANYSTAR, 0); |
| | @@ -7722,10 +7731,18 @@ |
| 7722 | 7731 | if( j>0 && pRe->zInit[j-1]==0 ) j--; |
| 7723 | 7732 | pRe->nInit = j; |
| 7724 | 7733 | } |
| 7725 | 7734 | return pRe->zErr; |
| 7726 | 7735 | } |
| 7736 | + |
| 7737 | +/* |
| 7738 | +** Compute a reasonable limit on the length of the REGEXP NFA. |
| 7739 | +*/ |
| 7740 | +static int re_maxlen(sqlite3_context *context){ |
| 7741 | + sqlite3 *db = sqlite3_context_db_handle(context); |
| 7742 | + return 75 + sqlite3_limit(db, SQLITE_LIMIT_LIKE_PATTERN_LENGTH,-1)/2; |
| 7743 | +} |
| 7727 | 7744 | |
| 7728 | 7745 | /* |
| 7729 | 7746 | ** Implementation of the regexp() SQL function. This function implements |
| 7730 | 7747 | ** the build-in REGEXP operator. The first argument to the function is the |
| 7731 | 7748 | ** pattern and the second argument is the string. So, the SQL statements: |
| | @@ -7748,11 +7765,12 @@ |
| 7748 | 7765 | (void)argc; /* Unused */ |
| 7749 | 7766 | pRe = sqlite3_get_auxdata(context, 0); |
| 7750 | 7767 | if( pRe==0 ){ |
| 7751 | 7768 | zPattern = (const char*)sqlite3_value_text(argv[0]); |
| 7752 | 7769 | if( zPattern==0 ) return; |
| 7753 | | - zErr = re_compile(&pRe, zPattern, sqlite3_user_data(context)!=0); |
| 7770 | + zErr = re_compile(&pRe, zPattern, re_maxlen(context), |
| 7771 | + sqlite3_user_data(context)!=0); |
| 7754 | 7772 | if( zErr ){ |
| 7755 | 7773 | re_free(pRe); |
| 7756 | 7774 | sqlite3_result_error(context, zErr, -1); |
| 7757 | 7775 | return; |
| 7758 | 7776 | } |
| | @@ -7793,11 +7811,12 @@ |
| 7793 | 7811 | char *z; |
| 7794 | 7812 | (void)argc; |
| 7795 | 7813 | |
| 7796 | 7814 | zPattern = (const char*)sqlite3_value_text(argv[0]); |
| 7797 | 7815 | if( zPattern==0 ) return; |
| 7798 | | - zErr = re_compile(&pRe, zPattern, sqlite3_user_data(context)!=0); |
| 7816 | + zErr = re_compile(&pRe, zPattern, re_maxlen(context), |
| 7817 | + sqlite3_user_data(context)!=0); |
| 7799 | 7818 | if( zErr ){ |
| 7800 | 7819 | re_free(pRe); |
| 7801 | 7820 | sqlite3_result_error(context, zErr, -1); |
| 7802 | 7821 | return; |
| 7803 | 7822 | } |
| 7804 | 7823 | |