From: Vsevolod Stakhov <vsevolod@rspamd.com>
Date: Fri, 22 Mar 2024 17:07:58 +0000 (+0000)
Subject: [CritFix] Protect regexp matcher from regexps with empty patterns
X-Git-Tag: 3.9.0~85^2~1
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=2038f3c92afaaeceab3e7107a38c06f8d555ae53;p=rspamd.git

[CritFix] Protect regexp matcher from regexps with empty patterns

Issue: #4885
Closes: #4885
---

diff --git a/src/libserver/re_cache.c b/src/libserver/re_cache.c
index 647375bcd..0644980da 100644
--- a/src/libserver/re_cache.c
+++ b/src/libserver/re_cache.c
@@ -632,6 +632,11 @@ rspamd_re_cache_process_pcre(struct rspamd_re_runtime *rt,
 			if (max_hits > 0 && r >= max_hits) {
 				break;
 			}
+
+			if (start >= end) {
+				/* We found all matches, so no more hits are possible (protect from empty patterns) */
+				break;
+			}
 		}
 
 		rt->results[id] += r;
diff --git a/src/libutil/multipattern.c b/src/libutil/multipattern.c
index 3c9be0df3..9ae798bb9 100644
--- a/src/libutil/multipattern.c
+++ b/src/libutil/multipattern.c
@@ -717,6 +717,10 @@ int rspamd_multipattern_lookup(struct rspamd_multipattern *mp,
 										&end,
 										TRUE,
 										NULL)) {
+				if (start >= end) {
+					/* We found all matches, so no more hits are possible (protect from empty patterns) */
+					break;
+				}
 				if (rspamd_multipattern_acism_cb(i, end - in, &cbd)) {
 					goto out;
 				}
diff --git a/src/lua/lua_regexp.c b/src/lua/lua_regexp.c
index 6e2b0dc22..4a209057e 100644
--- a/src/lua/lua_regexp.c
+++ b/src/lua/lua_regexp.c
@@ -543,6 +543,11 @@ lua_regexp_search(lua_State *L)
 				}
 
 				matched = TRUE;
+
+				if (start >= end) {
+					/* We found all matches, so no more hits are possible (protect from empty patterns) */
+					break;
+				}
 			}
 
 			if (!matched) {
@@ -749,7 +754,7 @@ lua_regexp_split(lua_State *L)
 					lua_rawseti(L, -2, ++i);
 					matched = TRUE;
 				}
-				else if (start == end) {
+				else if (start >= end) {
 					break;
 				}
 				old_start = end;