ref: b6de34ac6d8bb7dd5461c57940acfbd3ee7fd93e
parent: 5008105780c0b0182ea6eda83ad5598f225be3ee
author: Tor Andersson <tor.andersson@artifex.com>
date: Mon Oct 31 08:58:24 EDT 2016
Fix 697281: numeric overflow in regular expression repetition count.
--- a/regexp.c
+++ b/regexp.c
@@ -157,7 +157,7 @@
g->yymin = g->yymin * 10 + dec(g, g->yychar);
g->yychar = *g->source++;
}
- if (g->yymin >= REPINF)
+ if (g->yymin < 0 || g->yymin >= REPINF)
die(g, "numeric overflow");
if (g->yychar == ',') {@@ -171,7 +171,7 @@
g->yymax = g->yymax * 10 + dec(g, g->yychar);
g->yychar = *g->source++;
}
- if (g->yymax >= REPINF)
+ if (g->yymax < 0 || g->yymax >= REPINF)
die(g, "numeric overflow");
}
} else {