Skip to content

Set a hard limit on input length #129

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
laurikari merged 2 commits into from
Jan 7, 2026
Merged

Set a hard limit on input length #129

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ad26b6d
Avoid crashing on large inputs
dag-erling Dec 22, 2025
70e91f9
Add tests for our newly introduced limits
dag-erling Dec 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions configure.ac
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ dnl Checks for compiler characteristics.
AC_USE_SYSTEM_EXTENSIONS
AC_C_CONST
AC_C_INLINE
AC_TYPE_SSIZE_T

tre_version_1=`echo $PACKAGE_VERSION | cut -d . -f 1`
tre_version_2=`echo $PACKAGE_VERSION | cut -d . -f 2`
Expand Down
27 changes: 13 additions & 14 deletions lib/regexec.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,7 +136,7 @@ tre_have_approx(const regex_t *preg)
}

static int
tre_match(const tre_tnfa_t *tnfa, const void *string, size_t len,
tre_match(const tre_tnfa_t *tnfa, const void *string, ssize_t len,
tre_str_type_t type, size_t nmatch, regmatch_t pmatch[],
int eflags)
{
Expand Down Expand Up @@ -171,7 +171,7 @@ tre_match(const tre_tnfa_t *tnfa, const void *string, size_t len,
return REG_BADPAT;
}
}
status = tre_tnfa_run_backtrack(tnfa, string, (int)len, type,
status = tre_tnfa_run_backtrack(tnfa, string, len, type,
tags, eflags, &eo);
}
#ifdef TRE_APPROX
Expand All @@ -183,14 +183,14 @@ tre_match(const tre_tnfa_t *tnfa, const void *string, size_t len,
tre_regaparams_default(&params);
params.max_err = 0;
params.max_cost = 0;
status = tre_tnfa_run_approx(tnfa, string, (int)len, type, tags,
status = tre_tnfa_run_approx(tnfa, string, len, type, tags,
&match, params, eflags, &eo);
}
#endif /* TRE_APPROX */
else
{
/* Exact matching, no back references, use the parallel matcher. */
status = tre_tnfa_run_parallel(tnfa, string, (int)len, type,
status = tre_tnfa_run_parallel(tnfa, string, len, type,
tags, eflags, &eo);
}

Expand Down Expand Up @@ -225,7 +225,7 @@ tre_regexec(const regex_t *preg, const char *str,
size_t nmatch, regmatch_t pmatch[], int eflags)
#endif
{
return tre_regnexec(preg, str, (unsigned)-1, nmatch, pmatch, eflags);
return tre_regnexec(preg, str, -1, nmatch, pmatch, eflags);
}

int
Expand All @@ -234,7 +234,7 @@ tre_regexecb(const regex_t *preg, const char *str,
{
tre_tnfa_t *tnfa = (void *)preg->TRE_REGEX_T_FIELD;

return tre_match(tnfa, str, (unsigned)-1, STR_BYTE, nmatch, pmatch, eflags);
return tre_match(tnfa, str, -1, STR_BYTE, nmatch, pmatch, eflags);
}

int
Expand All @@ -261,7 +261,7 @@ int
tre_regwexec(const regex_t *preg, const wchar_t *str,
size_t nmatch, regmatch_t pmatch[], int eflags)
{
return tre_regwnexec(preg, str, (unsigned)-1, nmatch, pmatch, eflags);
return tre_regwnexec(preg, str, -1, nmatch, pmatch, eflags);
}

#endif /* TRE_WCHAR */
Expand All @@ -271,7 +271,7 @@ tre_reguexec(const regex_t *preg, const tre_str_source *str,
size_t nmatch, regmatch_t pmatch[], int eflags)
{
tre_tnfa_t *tnfa = (void *)preg->TRE_REGEX_T_FIELD;
return tre_match(tnfa, str, (unsigned)-1, STR_USER, nmatch, pmatch, eflags);
return tre_match(tnfa, str, -1, STR_USER, nmatch, pmatch, eflags);
}


Expand All @@ -282,7 +282,7 @@ tre_reguexec(const regex_t *preg, const tre_str_source *str,
*/

static int
tre_match_approx(const tre_tnfa_t *tnfa, const void *string, size_t len,
tre_match_approx(const tre_tnfa_t *tnfa, const void *string, ssize_t len,
tre_str_type_t type, regamatch_t *match, regaparams_t params,
int eflags)
{
Expand Down Expand Up @@ -311,7 +311,7 @@ tre_match_approx(const tre_tnfa_t *tnfa, const void *string, size_t len,
if (tags == NULL)
return REG_ESPACE;
}
status = tre_tnfa_run_approx(tnfa, string, (int)len, type, tags,
status = tre_tnfa_run_approx(tnfa, string, len, type, tags,
match, params, eflags, &eo);
if (status == REG_OK)
tre_fill_pmatch(match->nmatch, match->pmatch, tnfa->cflags, tnfa, tags, eo);
Expand All @@ -336,7 +336,7 @@ int
tre_regaexec(const regex_t *preg, const char *str,
regamatch_t *match, regaparams_t params, int eflags)
{
return tre_reganexec(preg, str, (unsigned)-1, match, params, eflags);
return tre_reganexec(preg, str, -1, match, params, eflags);
}

int
Expand All @@ -345,8 +345,7 @@ tre_regaexecb(const regex_t *preg, const char *str,
{
tre_tnfa_t *tnfa = (void *)preg->TRE_REGEX_T_FIELD;

return tre_match_approx(tnfa, str, (unsigned)-1, STR_BYTE,
match, params, eflags);
return tre_match_approx(tnfa, str, -1, STR_BYTE, match, params, eflags);
}

#ifdef TRE_WCHAR
Expand All @@ -364,7 +363,7 @@ int
tre_regawexec(const regex_t *preg, const wchar_t *str,
regamatch_t *match, regaparams_t params, int eflags)
{
return tre_regawnexec(preg, str, (unsigned)-1, match, params, eflags);
return tre_regawnexec(preg, str, -1, match, params, eflags);
}

#endif /* TRE_WCHAR */
Expand Down
24 changes: 14 additions & 10 deletions lib/tre-internal.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,13 +15,18 @@

#ifdef HAVE_WCTYPE_H
#include <wctype.h>
#endif /* !HAVE_WCTYPE_H */
#endif /* HAVE_WCTYPE_H */

#ifdef HAVE_SYS_TYPES_H
#include <sys/types.h>
#endif /* HAVE_SYS_TYPES_H */

#include <limits.h>
#include <ctype.h>
#include "../local_includes/tre.h"

#define TRE_MAX_RE 65536
#define TRE_MAX_STRING INT_MAX
#define TRE_MAX_STACK 1048576

#ifdef TRE_DEBUG
Expand Down Expand Up @@ -268,26 +273,25 @@ tre_fill_pmatch(size_t nmatch, regmatch_t pmatch[], int cflags,
const tre_tnfa_t *tnfa, int *tags, int match_eo);

reg_errcode_t
tre_tnfa_run_parallel(const tre_tnfa_t *tnfa, const void *string, int len,
tre_tnfa_run_parallel(const tre_tnfa_t *tnfa, const void *string, ssize_t len,
tre_str_type_t type, int *match_tags, int eflags,
int *match_end_ofs);

reg_errcode_t
tre_tnfa_run_parallel(const tre_tnfa_t *tnfa, const void *string, int len,
tre_tnfa_run_parallel(const tre_tnfa_t *tnfa, const void *string, ssize_t len,
tre_str_type_t type, int *match_tags, int eflags,
int *match_end_ofs);

reg_errcode_t
tre_tnfa_run_backtrack(const tre_tnfa_t *tnfa, const void *string,
int len, tre_str_type_t type, int *match_tags,
int eflags, int *match_end_ofs);
tre_tnfa_run_backtrack(const tre_tnfa_t *tnfa, const void *string, ssize_t len,
tre_str_type_t type, int *match_tags, int eflags,
int *match_end_ofs);

#ifdef TRE_APPROX
reg_errcode_t
tre_tnfa_run_approx(const tre_tnfa_t *tnfa, const void *string, int len,
tre_str_type_t type, int *match_tags,
regamatch_t *match, regaparams_t params,
int eflags, int *match_end_ofs);
tre_tnfa_run_approx(const tre_tnfa_t *tnfa, const void *string, ssize_t len,
tre_str_type_t type, int *match_tags, regamatch_t *match,
regaparams_t params, int eflags, int *match_end_ofs);
#endif /* TRE_APPROX */

#endif /* TRE_INTERNAL_H */
Expand Down
45 changes: 28 additions & 17 deletions lib/tre-match-approx.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -197,22 +197,23 @@ tre_set_params(tre_tnfa_approx_reach_t *reach,
}

reg_errcode_t
tre_tnfa_run_approx(const tre_tnfa_t *tnfa, const void *string, int len,
tre_tnfa_run_approx(const tre_tnfa_t *tnfa, const void *string, ssize_t len,
tre_str_type_t type, int *match_tags,
regamatch_t *match, regaparams_t default_params,
int eflags, int *match_end_ofs)
{
/* State variables required by GET_NEXT_WCHAR. */
tre_char_t prev_c = 0, next_c = 0;
const char *str_byte = string;
int pos = -1;
ssize_t pos = -1;
unsigned int pos_add_next = 1;
#ifdef TRE_WCHAR
const wchar_t *str_wide = string;
#ifdef TRE_MBSTATE
mbstate_t mbstate;
#endif /* !TRE_WCHAR */
#endif /* TRE_WCHAR */
reg_errcode_t ret;
int reg_notbol = eflags & REG_NOTBOL;
int reg_noteol = eflags & REG_NOTEOL;
int reg_newline = tnfa->cflags & REG_NEWLINE;
Expand All @@ -237,16 +238,20 @@ tre_tnfa_run_approx(const tre_tnfa_t *tnfa, const void *string, int len,

int i, id;

if (!match_tags)
num_tags = 0;
else
num_tags = tnfa->num_tags;
/*
* TRE internals tend to use int instead of size_t for positions or
* lengths and don't check for overflow. This will take time to fix
* properly. In the meantime, simply limit the input to what we can
* handle.
*/
if (len > TRE_MAX_STRING)
len = TRE_MAX_STRING;

#ifdef TRE_MBSTATE
memset(&mbstate, '\0', sizeof(mbstate));
#endif /* TRE_MBSTATE */

DPRINT(("tre_tnfa_run_approx, input type %d, len %d, eflags %d, "
DPRINT(("tre_tnfa_run_approx, input type %d, len %zd, eflags %d, "
"match_tags %p\n",
type, len, eflags,
match_tags));
Expand All @@ -256,6 +261,11 @@ tre_tnfa_run_approx(const tre_tnfa_t *tnfa, const void *string, int len,
default_params.cost_del,
default_params.cost_subst));

if (!match_tags)
num_tags = 0;
else
num_tags = tnfa->num_tags;

/* Allocate memory for temporary data required for matching. This needs to
be done for every matching operation to be thread safe. This allocates
everything in a single large block from the stack frame using alloca()
Expand Down Expand Up @@ -321,7 +331,7 @@ tre_tnfa_run_approx(const tre_tnfa_t *tnfa, const void *string, int len,

while (/*CONSTCOND*/(void)1,1)
{
DPRINT(("%03d:%2lc/%05d\n", pos, (tre_cint_t)next_c, (int)next_c));
DPRINT(("%03zd:%2lc/%05d\n", pos, (tre_cint_t)next_c, (int)next_c));

/* Add initial states to `reach_next' if an exact match has not yet
been found. */
Expand Down Expand Up @@ -595,7 +605,7 @@ tre_tnfa_run_approx(const tre_tnfa_t *tnfa, const void *string, int len,
&& (num_tags > 0
&& tmp_tags[0] <= match_tags[0]))))
{
DPRINT((" setting new match at %d, cost %d\n",
DPRINT((" setting new match at %zd, cost %d\n",
pos, cost0));
match_eo = pos;
memcpy(match_costs, reach_next[dest_id].costs[0],
Expand Down Expand Up @@ -630,7 +640,7 @@ tre_tnfa_run_approx(const tre_tnfa_t *tnfa, const void *string, int len,
if (str_user_end)
break;
}
else if (next_c == L'\0')
else if (next_c == L'\0' || pos >= TRE_MAX_STRING)
break;
}
else
Expand Down Expand Up @@ -778,7 +788,7 @@ tre_tnfa_run_approx(const tre_tnfa_t *tnfa, const void *string, int len,
|| (cost0 == match_costs[TRE_M_COST]
&& num_tags > 0 && tmp_tags[0] <= match_tags[0])))
{
DPRINT((" setting new match at %d, cost %d\n",
DPRINT((" setting new match at %zd, cost %d\n",
pos, cost0));
match_eo = pos;
for (i = 0; i < TRE_M_LAST; i++)
Expand All @@ -793,16 +803,17 @@ tre_tnfa_run_approx(const tre_tnfa_t *tnfa, const void *string, int len,
DPRINT(("match end offset = %d, match cost = %d\n", match_eo,
match_costs[TRE_M_COST]));

#ifndef TRE_USE_ALLOCA
if (buf)
xfree(buf);
#endif /* !TRE_USE_ALLOCA */

match->cost = match_costs[TRE_M_COST];
match->num_ins = match_costs[TRE_M_NUM_INS];
match->num_del = match_costs[TRE_M_NUM_DEL];
match->num_subst = match_costs[TRE_M_NUM_SUBST];
*match_end_ofs = match_eo;

return match_eo >= 0 ? REG_OK : REG_NOMATCH;
ret = match_eo >= 0 ? REG_OK : REG_NOMATCH;

#ifndef TRE_USE_ALLOCA
if (buf)
xfree(buf);
#endif /* !TRE_USE_ALLOCA */
return ret;
}
Loading
Loading