Changeset 591

Timestamp:

Oct 31, 2025, 2:49:53 PM (8 hours ago)

Author:

katerina

Message:

Fix for ticket #479 (check for start of a pcre2 match later than its end).

Location:

trunk/src

Files:

• sh_log_evalrule.c (modified) (1 diff)
• sh_log_parse_apache.c (modified) (2 diffs)

trunk/src/sh_log_evalrule.c

@@ -1051 +1051 @@
                                                 sh_string_len(message));
 
-  if (ovecnum > 1)
+  if (ovecnum > 1 && (ovector[0] < ovector[1])) /* guard against patterns using \K */
     {
       retval = sh_string_replace(retval, &(ovector[2]), (ovecnum-1), "___", 3);

trunk/src/sh_log_parse_apache.c

@@ -341 +341 @@
 
       info->line_ovector = pcre2_get_ovector_pointer(match_data);
+
+      if (info->line_ovector[0] > info->line_ovector[1]) /* guard against patterns using \K */
+        {
+          char msg[128];
+          sl_snprintf(msg, sizeof(msg), _("Matching error: start > end"));
+          
+          SH_MUTEX_LOCK(mutex_thread_nolog);
+          sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, 0, MSG_E_SUBGEN,
+                          msg,
+                          _("sh_parse_apache"));
+          SH_MUTEX_UNLOCK(mutex_thread_nolog);
+          goto the_end;
+        }
       
       if (info->pos_time > 0)
@@ -450 +463 @@
     sh_string_destroy(&msg);
   }
+  
+ the_end:
   pcre2_match_data_free(match_data);
   return NULL;