Vulnerability: A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial of service by providing a crafted regular expression. Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.
Vulnerability ID: CVE-2019-13225
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/kkos/oniguruma
Published: 2019-07-10
File: src/regcomp.c
Commit message: Fix CVE-2019-13225: problem in converting if-then-else pattern to bytecode.
Commit author: K.Kosako

Vulnerable version (before fix):
 compile_length_bag_node(BagNode* node, regex_t* reg)         len += tlen;       }        if (IS_NOT_NULL(Else)) {         len += SIZE_OP_JUMP;         tlen = compile_length_tree(Else, reg);         if (tlen < 0) return tlen;         len += tlen; compile_bag_node(BagNode* node, regex_t* reg, ScanEnv* env)    case BAG_IF_ELSE:     {       int cond_len, then_len, jump_len;       Node* cond = NODE_BAG_BODY(node);       Node* Then = node->te.Then;       Node* Else = node->te.Else; compile_bag_node(BagNode* node, regex_t* reg, ScanEnv* env)       else         then_len = 0;        jump_len = cond_len + then_len + SIZE_OP_ATOMIC_END;       if (IS_NOT_NULL(Else)) jump_len += SIZE_OP_JUMP;        r = add_op(reg, OP_PUSH);       if (r != 0) return r; compile_bag_node(BagNode* node, regex_t* reg, ScanEnv* env)       }        if (IS_NOT_NULL(Else)) {         int else_len = compile_length_tree(Else, reg);         r = add_op(reg, OP_JUMP);         if (r != 0) return r;         COP(reg)->jump.addr = else_len + SIZE_INC_OP;          r = compile_tree(Else, reg, env);       }     }

Fixed version (after fix):
 compile_length_bag_node(BagNode* node, regex_t* reg)         len += tlen;       }        len += SIZE_OP_JUMP + SIZE_OP_ATOMIC_END;        if (IS_NOT_NULL(Else)) {         tlen = compile_length_tree(Else, reg);         if (tlen < 0) return tlen;         len += tlen; compile_bag_node(BagNode* node, regex_t* reg, ScanEnv* env)    case BAG_IF_ELSE:     {       int cond_len, then_len, else_len, jump_len;       Node* cond = NODE_BAG_BODY(node);       Node* Then = node->te.Then;       Node* Else = node->te.Else; compile_bag_node(BagNode* node, regex_t* reg, ScanEnv* env)       else         then_len = 0;        jump_len = cond_len + then_len + SIZE_OP_ATOMIC_END + SIZE_OP_JUMP;        r = add_op(reg, OP_PUSH);       if (r != 0) return r; compile_bag_node(BagNode* node, regex_t* reg, ScanEnv* env)       }        if (IS_NOT_NULL(Else)) {         else_len = compile_length_tree(Else, reg);         if (else_len < 0) return else_len;       }       else         else_len = 0;        r = add_op(reg, OP_JUMP);       if (r != 0) return r;       COP(reg)->jump.addr = SIZE_OP_ATOMIC_END + else_len + SIZE_INC_OP;        r = add_op(reg, OP_ATOMIC_END);       if (r != 0) return r;        if (IS_NOT_NULL(Else)) {         r = compile_tree(Else, reg, env);       }     }

Patch:
patch: @@ -1307,8 +1307,9 @@ compile_length_bag_node(BagNode* node, regex_t* reg)
         len += tlen;
       }
 
+      len += SIZE_OP_JUMP + SIZE_OP_ATOMIC_END;
+
       if (IS_NOT_NULL(Else)) {
-        len += SIZE_OP_JUMP;
         tlen = compile_length_tree(Else, reg);
         if (tlen < 0) return tlen;
         len += tlen;
@@ -1455,7 +1456,7 @@ compile_bag_node(BagNode* node, regex_t* reg, ScanEnv* env)
 
   case BAG_IF_ELSE:
     {
-      int cond_len, then_len, jump_len;
+      int cond_len, then_len, else_len, jump_len;
       Node* cond = NODE_BAG_BODY(node);
       Node* Then = node->te.Then;
       Node* Else = node->te.Else;
@@ -1472,8 +1473,7 @@ compile_bag_node(BagNode* node, regex_t* reg, ScanEnv* env)
       else
         then_len = 0;
 
-      jump_len = cond_len + then_len + SIZE_OP_ATOMIC_END;
-      if (IS_NOT_NULL(Else)) jump_len += SIZE_OP_JUMP;
+      jump_len = cond_len + then_len + SIZE_OP_ATOMIC_END + SIZE_OP_JUMP;
 
       r = add_op(reg, OP_PUSH);
       if (r != 0) return r;
@@ -1490,11 +1490,20 @@ compile_bag_node(BagNode* node, regex_t* reg, ScanEnv* env)
       }
 
       if (IS_NOT_NULL(Else)) {
-        int else_len = compile_length_tree(Else, reg);
-        r = add_op(reg, OP_JUMP);
-        if (r != 0) return r;
-        COP(reg)->jump.addr = else_len + SIZE_INC_OP;
+        else_len = compile_length_tree(Else, reg);
+        if (else_len < 0) return else_len;
+      }
+      else
+        else_len = 0;
 
+      r = add_op(reg, OP_JUMP);
+      if (r != 0) return r;
+      COP(reg)->jump.addr = SIZE_OP_ATOMIC_END + else_len + SIZE_INC_OP;
+
+      r = add_op(reg, OP_ATOMIC_END);
+      if (r != 0) return r;
+
+      if (IS_NOT_NULL(Else)) {
         r = compile_tree(Else, reg, env);
       }
     }
path: src/regcomp.c