librdkafka
librdkafka copied to clipboard
Fix out-of-bounds memory accesses in regex parsing
This PR fixes out-of-bounds memory accesses in regex parsing found by OSS-Fuzz.
Out-of-bounds write
The implicit casting from integer to unsigned char of min & max in parserep
allowed a maliciously crafted input to bypass the max < min
check in parserep. This would later lead to a mismatch between the result of count
and the number of emit
calls, resulting in an heap out-of-bounds write in emit
.
Example input: 3{3,65}3{55555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555553,65}35{61,}
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27631 Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27735
Out-of-bounds read in parseatom
Example input: ((((((((((((((((\17+
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28561