CVE-2017-9226 (published 2017-05-24T15:29Z)

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/kkos/oniguruma
commit_details: repo_url: https://github.com/kkos/oniguruma
author: K.Kosako
author_date: 2017-05-19 15:44:47+09:00
msg: fix #55 : Byte value expressed in octal must be smaller than 256
repository: repo_url: https://github.com/kkos/oniguruma
repo_name: kkos/oniguruma
description: regular expression library
repo_language: C
owner: kkos
file_changes: filename: regparse.c
change_type: ModificationType.MODIFY
diff: @@ -3020,7 +3020,7 @@ fetch_token_in_cc(OnigToken* tok, UChar** src, UChar* end, ScanEnv* env)
         PUNFETCH;
         prev = p;
         num = scan_unsigned_octal_number(&p, end, 3, enc);
-        if (num < 0) return ONIGERR_TOO_BIG_NUMBER;
+        if (num < 0 || num >= 256) return ONIGERR_TOO_BIG_NUMBER;
         if (p == prev) {  /* can't read nothing. */
           num = 0; /* but, it's not error */
         }
@@ -3392,7 +3392,7 @@ fetch_token(OnigToken* tok, UChar** src, UChar* end, ScanEnv* env)
       if (IS_SYNTAX_OP(syn, ONIG_SYN_OP_ESC_OCTAL3)) {
         prev = p;
         num = scan_unsigned_octal_number(&p, end, (c == '0' ? 2:3), enc);
-        if (num < 0) return ONIGERR_TOO_BIG_NUMBER;
+        if (num < 0 || num >= 256) return ONIGERR_TOO_BIG_NUMBER;
         if (p == prev) {  /* can't read nothing. */
           num = 0; /* but, it's not error */
         }

programming_language: C
repo_url: https://github.com/kkos/oniguruma
commit_details: repo_url: https://github.com/kkos/oniguruma
author: K.Kosako
author_date: 2017-05-18 17:05:27+09:00
msg: fix #55 : check too big code point value for single byte value in next_state_val()
repository: repo_url: https://github.com/kkos/oniguruma
repo_name: kkos/oniguruma
description: regular expression library
repo_language: C
owner: kkos
file_changes: filename: regparse.c
change_type: ModificationType.MODIFY
diff: @@ -4044,6 +4044,9 @@ next_state_val(CClassNode* cc, OnigCodePoint *vs, OnigCodePoint v,
   switch (*state) {
   case CCS_VALUE:
     if (*type == CCV_SB) {
+      if (*vs > 0xff)
+          return ONIGERR_INVALID_CODE_POINT_VALUE;
+
       BITSET_SET_BIT(cc->bs, (int )(*vs));
     }
     else if (*type == CCV_CODE_POINT) {

programming_language: C