From: K.Kosako <kosako@sofnec.co.jp>
Date: Mon, 29 Jul 2019 06:49:51 +0000 (+0900)
Subject: fix fatal endless loop found by libfuzzer
X-Git-Tag: v6.9.3~21
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=8a1c05cd29342a1a0c95530dee4b08b23d113746;p=onig

fix fatal endless loop found by libfuzzer
---

diff --git a/src/regexec.c b/src/regexec.c
index e7818e0..a79c0b3 100644
--- a/src/regexec.c
+++ b/src/regexec.c
@@ -1950,9 +1950,10 @@ stack_double(int is_alloca, char** arg_alloc_base,
         }\
         else {\
           UChar* endp;\
+          int level = 0;\
           (isnull) = 1;\
           while (k < stk) {\
-            if (k->type == STK_MEM_START) {\
+            if (k->type == STK_MEM_START && level == 0) {\
               STACK_MEM_START_GET_PREV_END_ADDR(k, reg, endp);\
               if (endp == 0) {\
                 (isnull) = 0; break;\
@@ -1964,6 +1965,12 @@ stack_double(int is_alloca, char** arg_alloc_base,
                 (isnull) = -1; /* empty, but position changed */ \
               }\
             }\
+            else if (k->type == STK_PREC_READ_START) {\
+              level++;\
+            }\
+            else if (k->type == STK_PREC_READ_END) {\
+              level--;\
+            }\
             k++;\
           }\
           break;\
@@ -1988,10 +1995,11 @@ stack_double(int is_alloca, char** arg_alloc_base,
           }\
           else {\
             UChar* endp;\
+            int prec_level = 0;\
             (isnull) = 1;\
             while (k < stk) {\
               if (k->type == STK_MEM_START) {\
-                if (level == 0) {\
+                if (level == 0 && prec_level == 0) {\
                   STACK_MEM_START_GET_PREV_END_ADDR(k, reg, endp);\
                   if (endp == 0) {\
                     (isnull) = 0; break;\
@@ -2010,6 +2018,12 @@ stack_double(int is_alloca, char** arg_alloc_base,
               else if (k->type == STK_EMPTY_CHECK_END) {\
                 if (k->zid == (sid)) level--;\
               }\
+              else if (k->type == STK_PREC_READ_START) {\
+                prec_level++;\
+              }\
+              else if (k->type == STK_PREC_READ_END) {\
+                prec_level--;\
+              }\
               k++;\
             }\
             break;\