oss-security - Re: Re: Re: Re: CVE-2015-3217: PCRE Library Call Stack Overflow Vulnerability in match()

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <tencent_323A2A4F3543CA8C5DA2E0E7@qq.com>
Date: Thu, 4 Jun 2015 08:58:10 +0800
From: "wen_guanxing" <wen_guanxing@...ustech.com.cn>
To: "oss-security" <oss-security@...ts.openwall.com>
Subject: Re: Re: Re: Re: CVE-2015-3217: PCRE Library Call Stack Overflow Vulnerability in match()

Although PHP is not setting the match_limit_recursion correctly, this pattern revealed a bug in the zero length recursion detector.Running the pattern with pcretest, the process will also hang.
It's fair to say that both PHP and PCRE has made a mistake.
I will report this later to PHP later.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.