CVE-2022-41409: Integer Overflow or Wraparound (CWE-190)
value: Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 7.5
Published: 2023-07-18T14:15Z
Repository: https://github.com/PCRE2Project/pcre2
Language: Other
Files changed: ChangeLog, src/pcre2test.c, testdata/testinput2, testdata/testoutput2
Commit date: 2022-08-16 17:00:45 +0100
Commit message: Diagnose negative repeat value in pcre2test subject line

Diff: diff --git a/ChangeLog b/ChangeLog
index eab50eb7..276eb57a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -73,10 +73,13 @@ greater than 127, it was incorrectly output in UTF-8 format.
 PCRE2_CALL_CONVENTION in src/pcre2posix.h. All function prototypes returning
 pointers had out of place PCRE2_CALL_CONVENTION in src/pcre2.h.*. These
 produced errors when building for Windows with #define PCRE2_CALL_CONVENTION
 __stdcall.
 
+20. A negative repeat value in a pcre2test subject line was not being 
+diagnosed, leading to infinite looping.
+
 
 Version 10.40 15-April-2022
 ---------------------------
 
 1. Merged patch from @carenas (GitHub #35, 7db87842) to fix pcre2grep incorrect
diff --git a/src/pcre2test.c b/src/pcre2test.c
index 08f86096..f6f5d66c 100644
--- a/src/pcre2test.c
+++ b/src/pcre2test.c
@@ -6842,13 +6842,13 @@ while ((c = *p++) != 0)
       fprintf(outfile, "** Expected '}' after \\[...]{...\n");
       return PR_OK;
       }
 
     i = (int32_t)li;
-    if (i-- == 0)
+    if (i-- <= 0)
       {
-      fprintf(outfile, "** Zero repeat not allowed\n");
+      fprintf(outfile, "** Zero or negative repeat not allowed\n");
       return PR_OK;
       }
 
     replen = CAST8VAR(q) - start_rep;
     needlen += replen * i;
diff --git a/testdata/testinput2 b/testdata/testinput2
index d37d8f30..717ba2ae 100644
--- a/testdata/testinput2
+++ b/testdata/testinput2
@@ -5930,6 +5930,9 @@ a)"xI
     aabcd
 
 /[Aa]{2,3}/BI
     aabcd
 
+--
+    \[X]{-10}
+
 # End of testinput2
diff --git a/testdata/testoutput2 b/testdata/testoutput2
index ce090f8c..d2188d3c 100644
--- a/testdata/testoutput2
+++ b/testdata/testoutput2
@@ -17744,10 +17744,14 @@ First code unit = 'A' (caseless)
 Last code unit = 'A' (caseless)
 Subject length lower bound = 2
     aabcd
  0: aa
 
+--
+    \[X]{-10}
+** Zero or negative repeat not allowed
+
 # End of testinput2
 Error -70: PCRE2_ERROR_BADDATA (unknown error number)
 Error -62: bad serialized data
 Error -2: partial match
 Error -1: no match

Vulnerable code:     if (i-- == 0)
      fprintf(outfile, "** Zero repeat not allowed\n");
Fixed code: 20. A negative repeat value in a pcre2test subject line was not being 
diagnosed, leading to infinite looping.

    if (i-- <= 0)
      fprintf(outfile, "** Zero or negative repeat not allowed\n");
--
    \[X]{-10}

--
    \[X]{-10}
** Zero or negative repeat not allowed