summaryrefslogtreecommitdiff
path: root/regexp.c
diff options
context:
space:
mode:
authorTor Andersson <tor.andersson@artifex.com>2016-10-31 12:58:24 +0100
committerTor Andersson <tor.andersson@artifex.com>2016-10-31 12:58:24 +0100
commitb6de34ac6d8bb7dd5461c57940acfbd3ee7fd93e (patch)
tree7f0937388feb15b8f17fe3c46f8906c5ebbfc6a6 /regexp.c
parent5008105780c0b0182ea6eda83ad5598f225be3ee (diff)
Fix 697281: numeric overflow in regular expression repetition count.
Diffstat (limited to 'regexp.c')
-rw-r--r--regexp.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/regexp.c b/regexp.c
index 76c4484..9852be2 100644
--- a/regexp.c
+++ b/regexp.c
@@ -157,7 +157,7 @@ static int lexcount(struct cstate *g)
g->yymin = g->yymin * 10 + dec(g, g->yychar);
g->yychar = *g->source++;
}
- if (g->yymin >= REPINF)
+ if (g->yymin < 0 || g->yymin >= REPINF)
die(g, "numeric overflow");
if (g->yychar == ',') {
@@ -171,7 +171,7 @@ static int lexcount(struct cstate *g)
g->yymax = g->yymax * 10 + dec(g, g->yychar);
g->yychar = *g->source++;
}
- if (g->yymax >= REPINF)
+ if (g->yymax < 0 || g->yymax >= REPINF)
die(g, "numeric overflow");
}
} else {