Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 4 Jun 2015 09:11:28 -0300
From: Felipe Pena <felipensp@...il.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: Re: Re: Re: Re: CVE-2015-3217: PCRE Library Call
 Stack Overflow Vulnerability in match()

On Wed, Jun 3, 2015 at 9:58 PM, wen_guanxing
<wen_guanxing@...ustech.com.cn> wrote:
> Although PHP is not setting the match_limit_recursion correctly, this pattern revealed a bug in the zero length recursion detector.Running the pattern with pcretest, the process will also hang.
> It's fair to say that both PHP and PCRE has made a mistake.
> I will report this later to PHP later.

AFAIK this is not a bug on PHP at all, this is a long time known issue
on PCRE lib instead.
Check the documentation for futher details:
http://pcre.org/current/doc/html/pcre2stack.html


-- 
Regards,
Felipe Pena

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.