Commit 41aa292e9 for clamav.net
commit 41aa292e97a314a585eefa4a1016915c5a1ebf15
Author: Shivam7-1 <55046031+Shivam7-1@users.noreply.github.com>
Date: Fri Apr 25 01:03:26 2025 +0530
Fix stack-buffer-overflow in parse_regex due to missing bounds checks (#1486)
Fixes: https://issues.oss-fuzz.com/issues/388922799
diff --git a/libclamav/regex_suffix.c b/libclamav/regex_suffix.c
index 1a2867b6f..1952eb6c8 100644
--- a/libclamav/regex_suffix.c
+++ b/libclamav/regex_suffix.c
@@ -274,7 +274,7 @@ static struct node *parse_regex(const uint8_t *p, const size_t pSize, size_t *la
struct node *right;
struct node *tmp;
- while (p[*last] != '$' && p[*last] != '\0') {
+ while (*last < pSize && p[*last] != '$' && p[*last] != '\0') {
switch (p[*last]) {
case '|':
++*last;
@@ -356,6 +356,7 @@ static struct node *parse_regex(const uint8_t *p, const size_t pSize, size_t *la
++*last;
/* fall-through */
default:
+ if (*last >= pSize) break;
right = make_leaf(p[*last]);
v = make_node(concat, v, right);
if (!v) {