git://git.exim.org
/
exim.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
Fix $regex<n> use-after-free. Bug 2915
[exim.git]
/
src
/
src
/
regex.c
diff --git
a/src/src/regex.c
b/src/src/regex.c
index 5de1c1704d02bc850d625b1d65b9f3d48209e9dd..25496f950db7d09debf46c15f902dda139965238 100644
(file)
--- a/
src/src/regex.c
+++ b/
src/src/regex.c
@@
-93,19
+93,27
@@
return FAIL;
}
}
+/* reset expansion variables */
+void
+regex_vars_clear(void)
+{
+regex_match_string = NULL;
+for (int i = 0; i < REGEX_VARS; i++) regex_vars[i] = NULL;
+}
+
+
int
int
-regex(const uschar **listptr, BOOL cacheable)
+regex(const uschar **
listptr, BOOL cacheable)
{
unsigned long mbox_size;
{
unsigned long mbox_size;
-FILE *mbox_file;
-pcre_list *re_list_head;
-uschar *linebuffer;
+FILE *
mbox_file;
+pcre_list *
re_list_head;
+uschar *
linebuffer;
long f_pos = 0;
int ret = FAIL;
long f_pos = 0;
int ret = FAIL;
-/* reset expansion variable */
-regex_match_string = NULL;
+regex_vars_clear();
if (!mime_stream) /* We are in the DATA ACL */
{
if (!mime_stream) /* We are in the DATA ACL */
{
@@
-167,14
+175,13
@@
return ret;
int
mime_regex(const uschar **listptr, BOOL cacheable)
{
int
mime_regex(const uschar **listptr, BOOL cacheable)
{
-pcre_list *re_list_head = NULL;
-FILE *f;
-uschar *mime_subject = NULL;
+pcre_list *
re_list_head = NULL;
+FILE *
f;
+uschar *
mime_subject = NULL;
int mime_subject_len = 0;
int ret;
int mime_subject_len = 0;
int ret;
-/* reset expansion variable */
-regex_match_string = NULL;
+regex_vars_clear();
/* precompile our regexes */
if (!(re_list_head = compile(*listptr, cacheable)))
/* precompile our regexes */
if (!(re_list_head = compile(*listptr, cacheable)))