diff options
author | Tor Andersson <tor.andersson@artifex.com> | 2016-10-31 12:58:24 +0100 |
---|---|---|
committer | Tor Andersson <tor.andersson@artifex.com> | 2016-10-31 12:58:24 +0100 |
commit | b6de34ac6d8bb7dd5461c57940acfbd3ee7fd93e (patch) | |
tree | 7f0937388feb15b8f17fe3c46f8906c5ebbfc6a6 /regexp.c | |
parent | 5008105780c0b0182ea6eda83ad5598f225be3ee (diff) |
Fix 697281: numeric overflow in regular expression repetition count.
Diffstat (limited to 'regexp.c')
-rw-r--r-- | regexp.c | 4 |
1 files changed, 2 insertions, 2 deletions
@@ -157,7 +157,7 @@ static int lexcount(struct cstate *g) g->yymin = g->yymin * 10 + dec(g, g->yychar); g->yychar = *g->source++; } - if (g->yymin >= REPINF) + if (g->yymin < 0 || g->yymin >= REPINF) die(g, "numeric overflow"); if (g->yychar == ',') { @@ -171,7 +171,7 @@ static int lexcount(struct cstate *g) g->yymax = g->yymax * 10 + dec(g, g->yychar); g->yychar = *g->source++; } - if (g->yymax >= REPINF) + if (g->yymax < 0 || g->yymax >= REPINF) die(g, "numeric overflow"); } } else { |