[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CA+5g0SLU4C2ma_otHorNKQ+u52N6yOYYmJ7sXcG7FvYKAgC3bg@mail.gmail.com>
Date: Thu, 4 Jun 2015 09:11:28 -0300
From: Felipe Pena <felipensp@...il.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: Re: Re: Re: Re: CVE-2015-3217: PCRE Library Call
Stack Overflow Vulnerability in match()
On Wed, Jun 3, 2015 at 9:58 PM, wen_guanxing
<wen_guanxing@...ustech.com.cn> wrote:
> Although PHP is not setting the match_limit_recursion correctly, this pattern revealed a bug in the zero length recursion detector.Running the pattern with pcretest, the process will also hang.
> It's fair to say that both PHP and PCRE has made a mistake.
> I will report this later to PHP later.
AFAIK this is not a bug on PHP at all, this is a long time known issue
on PCRE lib instead.
Check the documentation for futher details:
http://pcre.org/current/doc/html/pcre2stack.html
--
Regards,
Felipe Pena
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
