[CritFix] Protect regexp matcher from regexps with empty patterns

Issue: #4885
Closes: #4885

diff --git a/src/libserver/re_cache.c b/src/libserver/re_cache.c
index 647375bcda29b26deeeb2d1385c70fe47b3b72d0..0644980da09d89206ce96c28585df73c26d7d567 100644 (file)
--- a/src/libserver/re_cache.c
+++ b/src/libserver/re_cache.c
@@ -632,6 +632,11 @@ rspamd_re_cache_process_pcre(struct rspamd_re_runtime *rt,
                        if (max_hits > 0 && r >= max_hits) {
                                break;
                        }
+
+                       if (start >= end) {
+                               /* We found all matches, so no more hits are possible (protect from empty patterns) */
+                               break;
+                       }
                }
 
                rt->results[id] += r;

diff --git a/src/libutil/multipattern.c b/src/libutil/multipattern.c
index 3c9be0df303d10f1321ee521a1ceb52664322b69..9ae798bb9da6d045f1b0977c9dd3a170f16b9790 100644 (file)
--- a/src/libutil/multipattern.c
+++ b/src/libutil/multipattern.c
@@ -717,6 +717,10 @@ int rspamd_multipattern_lookup(struct rspamd_multipattern *mp,
                                                                                &end,
                                                                                TRUE,
                                                                                NULL)) {
+                               if (start >= end) {
+                                       /* We found all matches, so no more hits are possible (protect from empty patterns) */
+                                       break;
+                               }
                                if (rspamd_multipattern_acism_cb(i, end - in, &cbd)) {
                                        goto out;
                                }

diff --git a/src/lua/lua_regexp.c b/src/lua/lua_regexp.c
index 6e2b0dc22a78e913871a81cc7e1f9e36b800156c..4a209057e9870c9f098dd25799bc45aa8b39303f 100644 (file)
--- a/src/lua/lua_regexp.c
+++ b/src/lua/lua_regexp.c
@@ -543,6 +543,11 @@ lua_regexp_search(lua_State *L)
                                }
 
                                matched = TRUE;
+
+                               if (start >= end) {
+                                       /* We found all matches, so no more hits are possible (protect from empty patterns) */
+                                       break;
+                               }
                        }
 
                        if (!matched) {
@@ -749,7 +754,7 @@ lua_regexp_split(lua_State *L)
                                        lua_rawseti(L, -2, ++i);
                                        matched = TRUE;
                                }
-                               else if (start == end) {
+                               else if (start >= end) {
                                        break;
                                }
                                old_start = end;