CVE-2022-1586 (published 2022-05-16T21:15Z)

An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/PCRE2Project/pcre2
commit_details: repo_url: https://github.com/PCRE2Project/pcre2
author: Zoltan Herczeg
author_date: 2022-03-24 05:34:42+00:00
msg: Fix incorrect value reading in JIT.
repository: repo_url: https://github.com/PCRE2Project/pcre2
repo_name: PCRE2Project/pcre2
description: PCRE2 development is now based here.
repo_language: C
owner: PCRE2Project
file_changes: filename: pcre2_jit_compile.c
change_type: ModificationType.MODIFY
diff: @@ -7489,7 +7489,7 @@ while (*cc != XCL_END)
     {
     SLJIT_ASSERT(*cc == XCL_PROP || *cc == XCL_NOTPROP);
     cc++;
-    if (*cc == PT_CLIST && *cc == XCL_PROP)
+    if (*cc == PT_CLIST && cc[-1] == XCL_PROP)
       {
       other_cases = PRIV(ucd_caseless_sets) + cc[1];
       while (*other_cases != NOTACHAR)

programming_language: C
repo_url: https://github.com/PCRE2Project/pcre2
commit_details: repo_url: https://github.com/PCRE2Project/pcre2
author: Zoltan Herczeg
author_date: 2022-03-23 07:53:25+00:00
msg: Fixed a unicode properrty matching issue in JIT
repository: repo_url: https://github.com/PCRE2Project/pcre2
repo_name: PCRE2Project/pcre2
description: PCRE2 development is now based here.
repo_language: C
owner: PCRE2Project
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -92,6 +92,9 @@ pattern, the optimizing "must be present for a match" character check was not
 being flagged as caseless, causing some matches that should have succeeded to
 fail.
 
+23. Fixed a unicode properrty matching issue in JIT. The character was not
+fully read in caseless matching.
+
 
 Version 10.39 29-October-2021
 -----------------------------

programming_language: Markdown
filename: pcre2_jit_compile.c
change_type: ModificationType.MODIFY
diff: @@ -7489,7 +7489,7 @@ while (*cc != XCL_END)
     {
     SLJIT_ASSERT(*cc == XCL_PROP || *cc == XCL_NOTPROP);
     cc++;
-    if (*cc == PT_CLIST)
+    if (*cc == PT_CLIST && *cc == XCL_PROP)
       {
       other_cases = PRIV(ucd_caseless_sets) + cc[1];
       while (*other_cases != NOTACHAR)

programming_language: C
filename: pcre2_jit_test.c
change_type: ModificationType.MODIFY
diff: @@ -415,6 +415,7 @@ static struct regression_test_case regression_test_cases[] = {
 	{ MUP, 0, 0, 0 | F_NOMATCH, "[^\\p{Hangul}\\p{Z}]", " " },
 	{ MUP, 0, 0, 0, "[\\p{Lu}\\P{Latin}]+", "c\xEA\xA4\xAE,A,b" },
 	{ MUP, 0, 0, 0, "[\\x{a92e}\\p{Lu}\\P{Latin}]+", "c\xEA\xA4\xAE,A,b" },
+	{ CMUP, 0, 0, 0, "[^S]\\B", "\xe2\x80\x8a" },
 
 	/* Possible empty brackets. */
 	{ MU, A, 0, 0, "(?:|ab||bc|a)+d", "abcxabcabd" },

programming_language: C