oss-sec mailing list archives

Re: Re: Re: Re: CVE-2015-3217: PCRE Library Call Stack Overflow Vulnerability in match()

From: "wen_guanxing" <wen_guanxing () venustech com cn>
Date: Thu, 4 Jun 2015 08:58:10 +0800

Although PHP is not setting the match_limit_recursion correctly, this pattern revealed a bug in the zero length 
recursion detector.Running the pattern with pcretest, the process will also hang.
It's fair to say that both PHP and PCRE has made a mistake.
I will report this later to PHP later.

Current thread:

CVE-2015-3217: PCRE Library Call Stack Overflow Vulnerability in match() wen_guanxing (Jun 03)
- Re: CVE-2015-3217: PCRE Library Call Stack Overflow Vulnerability in match() Dan McDonald (Jun 03)
- <Possible follow-ups>
- Re: Re: CVE-2015-3217: PCRE Library Call Stack Overflow Vulnerability in match() Hhjack (Jun 03)
  - Re: Re: Re: CVE-2015-3217: PCRE Library Call Stack Overflow Vulnerability in match() Tavis Ormandy (Jun 03)
- Re: Re: Re: Re: CVE-2015-3217: PCRE Library Call Stack Overflow Vulnerability in match() wen_guanxing (Jun 03)
  - Re: Re: Re: Re: Re: CVE-2015-3217: PCRE Library Call Stack Overflow Vulnerability in match() Felipe Pena (Jun 04)
- Re: Re: Re: Re: Re: Re: CVE-2015-3217: PCRE Library Call Stack Overflow Vulnerability in match() Guanxing Wen (Jun 04)