From ea6af8d23101db9d575ada0fc659eb03cd2177d8 Mon Sep 17 00:00:00 2001
From: John Lightsey <jd@cpanel.net>
Date: Wed, 20 Nov 2019 20:02:45 -0600
Subject: [PATCH] regcomp.c: Prevent integer overflow from nested regex
 quantifiers.

(CVE-2020-10543) On 32bit systems the size calculations for nested regular
expression quantifiers could overflow causing heap memory corruption.

Fixes: Perl/perl5-security#125
(cherry picked from commit bfd31397db5dc1a5c5d3e0a1f753a4f89a736e71)

port from:
https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed

Signed-off-by: Peibao Liu <peibao.liu@windriver.com>
---
 regcomp.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff -Naur a/regcomp.c b/regcomp.c
--- a/regcomp.c	2020-07-14 14:52:25.197000000 -0400
+++ b/regcomp.c	2020-07-14 14:56:41.823000000 -0400
@@ -5181,6 +5181,12 @@
 		    (void)ReREFCNT_inc(RExC_rx_sv);
 		}
 
+                if ( ( minnext > 0 && mincount >= SSize_t_MAX / minnext )
+                    || min >= SSize_t_MAX - minnext * mincount )
+                {
+                    FAIL("Regexp out of space");
+                }
+
 		min += minnext * mincount;
 		is_inf_internal |= deltanext == SSize_t_MAX
                          || (maxcount == REG_INFTY && minnext + deltanext > 0);