oss-sec mailing list archives
Re: Re: Re: Re: Re: CVE-2015-3217: PCRE Library Call Stack Overflow Vulnerability in match()
From: Felipe Pena <felipensp () gmail com>
Date: Thu, 4 Jun 2015 09:11:28 -0300
On Wed, Jun 3, 2015 at 9:58 PM, wen_guanxing <wen_guanxing () venustech com cn> wrote:
Although PHP is not setting the match_limit_recursion correctly, this pattern revealed a bug in the zero length recursion detector.Running the pattern with pcretest, the process will also hang. It's fair to say that both PHP and PCRE has made a mistake. I will report this later to PHP later.
AFAIK this is not a bug on PHP at all, this is a long time known issue on PCRE lib instead. Check the documentation for futher details: http://pcre.org/current/doc/html/pcre2stack.html -- Regards, Felipe Pena
Current thread:
- CVE-2015-3217: PCRE Library Call Stack Overflow Vulnerability in match() wen_guanxing (Jun 03)
- Re: CVE-2015-3217: PCRE Library Call Stack Overflow Vulnerability in match() Dan McDonald (Jun 03)
- <Possible follow-ups>
- Re: Re: CVE-2015-3217: PCRE Library Call Stack Overflow Vulnerability in match() Hhjack (Jun 03)
- Re: Re: Re: CVE-2015-3217: PCRE Library Call Stack Overflow Vulnerability in match() Tavis Ormandy (Jun 03)
- Re: Re: Re: Re: CVE-2015-3217: PCRE Library Call Stack Overflow Vulnerability in match() wen_guanxing (Jun 03)
- Re: Re: Re: Re: Re: CVE-2015-3217: PCRE Library Call Stack Overflow Vulnerability in match() Felipe Pena (Jun 04)
- Re: Re: Re: Re: Re: Re: CVE-2015-3217: PCRE Library Call Stack Overflow Vulnerability in match() Guanxing Wen (Jun 04)