Subject: Re: bug#51710: [PATCH] pcre: avoid overflow in PCRE JIT stack resizing
From: Paul Eggert <[email-masked]>
To: Carlo Marcelo Arenas Belón <[email-masked]>
Cc: [email-masked]
Date: Tue, 9 Nov 2021 10:28:07 -0800
List-Id: <debbugs-submit.debbugs.gnu.org>

Thanks for reporting that. I installed the attached somewhat-simpler patch.

Does PCRE2 have a similar bug? If so, I suppose this should be reflected 
when we merge in the patch for bug#47264.

From f87b649c9157f60a09af4c2596288704e0057358 Mon Sep 17 00:00:00 2001
From: Paul Eggert <[email-masked]>
Date: Tue, 9 Nov 2021 10:11:42 -0800
Subject: [PATCH] grep: work around PCRE bug
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Problem reported by Carlo Marcelo Arenas Belón (Bug#51710).
* src/pcresearch.c (jit_exec): Don’t attempt to grow the JIT stack
over INT_MAX - 8 * 1024.
---
 src/pcresearch.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/pcresearch.c b/src/pcresearch.c
index 3bdaee9..09f92c8 100644
--- a/src/pcresearch.c
+++ b/src/pcresearch.c
@@ -72,8 +72,11 @@ jit_exec (struct pcre_comp *pc, char const *subject, int search_bytes,
                          search_offset, options, sub, NSUB);
 
 #if PCRE_STUDY_JIT_COMPILE
+      /* Going over this would trigger an int overflow bug within PCRE.  */
+      int jitstack_max = INT_MAX - 8 * 1024;
+
       if (e == PCRE_ERROR_JIT_STACKLIMIT
-          && 0 < pc->jit_stack_size && pc->jit_stack_size <= INT_MAX / 2)
+          && 0 < pc->jit_stack_size && pc->jit_stack_size <= jitstack_max / 2)
         {
           int old_size = pc->jit_stack_size;
           int new_size = pc->jit_stack_size = old_size * 2;
-- 
2.32.0