X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=pcrs.c;h=6da82255508c4d9a4b46f660e151712b673ed9d3;hp=156ae9882d1a64b4c72036849ee4bcd8a4926158;hb=551738b2e7ca91cf65acf5f6052b5e2cde47e957;hpb=f157fb3e5e3041012a88b37d07f0cb3817c75fda

diff --git a/pcrs.c b/pcrs.c
index 156ae988..6da82255 100644
--- a/pcrs.c
+++ b/pcrs.c
@@ -1,4 +1,3 @@
-const char pcrs_rcs[] = "$Id: pcrs.c,v 1.47 2015/01/24 16:40:59 fabiankeil Exp $";
 /*********************************************************************
  *
  * File        :  $Source: /cvsroot/ijbswa/current/pcrs.c,v $
@@ -17,21 +16,20 @@ const char pcrs_rcs[] = "$Id: pcrs.c,v 1.47 2015/01/24 16:40:59 fabiankeil Exp $
  *                Copyright (C) 2006, 2007 Fabian Keil <fk@fabiankeil.de>
  *
  *                This program is free software; you can redistribute it
- *                and/or modify it under the terms of the GNU Lesser
- *                General Public License (LGPL), version 2.1, which  should
- *                be included in this distribution (see LICENSE.txt), with
- *                the exception that the permission to replace that license
- *                with the GNU General Public License (GPL) given in section
- *                3 is restricted to version 2 of the GPL.
+ *                and/or modify it under the terms of the GNU General
+ *                Public License as published by the Free Software
+ *                Foundation; either version 2 of the License, or (at
+ *                your option) any later version.
  *
  *                This program is distributed in the hope that it will
  *                be useful, but WITHOUT ANY WARRANTY; without even the
  *                implied warranty of MERCHANTABILITY or FITNESS FOR A
- *                PARTICULAR PURPOSE.  See the license for more details.
+ *                PARTICULAR PURPOSE.  See the GNU General Public
+ *                License for more details.
  *
- *                The GNU Lesser General Public License should be included
- *                with this file.  If not, you can view it at
- *                http://www.gnu.org/licenses/lgpl.html
+ *                The GNU General Public License should be included with
+ *                this file.  If not, you can view it at
+ *                http://www.gnu.org/copyleft/gpl.html
  *                or write to the Free Software Foundation, Inc., 59
  *                Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  *
@@ -55,8 +53,6 @@ const char pcrs_rcs[] = "$Id: pcrs.c,v 1.47 2015/01/24 16:40:59 fabiankeil Exp $
 
 #include "pcrs.h"
 
-const char pcrs_h_rcs[] = PCRS_H_VERSION;
-
 /*
  * Internal prototypes
  */
@@ -182,6 +178,38 @@ static int pcrs_parse_perl_options(const char *optstring, int *flags)
 }
 
 
+#ifdef FUZZ
+/*********************************************************************
+ *
+ * Function    :  pcrs_compile_fuzzed_replacement
+ *
+ * Description :  Wrapper around pcrs_compile_replacement() for
+ *                fuzzing purposes.
+ *
+ * Parameters  :
+ *          1  :  replacement = replacement part of s/// operator
+ *                              in perl syntax
+ *          2  :  errptr = pointer to an integer in which error
+ *                         conditions can be returned.
+ *
+ * Returns     :  pcrs_substitute data structure, or NULL if an
+ *                error is encountered. In that case, *errptr has
+ *                the reason.
+ *
+ *********************************************************************/
+extern pcrs_substitute *pcrs_compile_fuzzed_replacement(const char *replacement, int *errptr)
+{
+   int capturecount = PCRS_MAX_SUBMATCHES; /* XXX: fuzzworthy? */
+   int trivial_flag = 0; /* We don't want to fuzz strncpy() */
+
+   *errptr = 0; /* XXX: Should pcrs_compile_replacement() do this? */
+
+   return pcrs_compile_replacement(replacement, trivial_flag, capturecount, errptr);
+
+}
+#endif
+
+
 /*********************************************************************
  *
  * Function    :  pcrs_compile_replacement
@@ -209,10 +237,13 @@ static int pcrs_parse_perl_options(const char *optstring, int *flags)
 static pcrs_substitute *pcrs_compile_replacement(const char *replacement, int trivialflag, int capturecount, int *errptr)
 {
    int i, k, l, quoted;
-   size_t length;
    char *text;
    pcrs_substitute *r;
-
+#ifndef FUZZ
+   size_t length;
+#else
+   static size_t length;
+#endif
    i = k = l = quoted = 0;
 
    /*
@@ -375,8 +406,11 @@ static pcrs_substitute *pcrs_compile_replacement(const char *replacement, int tr
                goto plainchar;
             }
 
+            assert(r->backref[l] < PCRS_MAX_SUBMATCHES + 2);
             /* Valid and in range? -> record */
-            if (0 <= r->backref[l] && r->backref[l] < PCRS_MAX_SUBMATCHES + 2)
+            if ((0 <= r->backref[l]) &&
+               (r->backref[l] < PCRS_MAX_SUBMATCHES + 2) &&
+               (l < PCRS_MAX_SUBMATCHES - 1))
             {
                r->backref_count[r->backref[l]] += 1;
                r->block_offset[++l] = k;