Blob Blame History Raw
From bc9b25b5d3c3784543158510c6087d41739ab64a Mon Sep 17 00:00:00 2001
From: jzmaddock <john@johnmaddock.co.uk>
Date: Mon, 31 Jul 2017 19:18:10 +0100
Subject: [PATCH] Fix potential overflow in max_state_count calculation. Fixes:
 https://svn.boost.org/trac10/ticket/13036.

---
 include/boost/regex/v4/perl_matcher_common.hpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/include/boost/regex/v4/perl_matcher_common.hpp b/include/boost/regex/v4/perl_matcher_common.hpp
index 7974e7483..f08e9d434 100644
--- a/include/boost/regex/v4/perl_matcher_common.hpp
+++ b/include/boost/regex/v4/perl_matcher_common.hpp
@@ -113,6 +113,11 @@ void perl_matcher<BidiIterator, Allocator, traits>::estimate_max_state_count(std
    std::ptrdiff_t states = re.size();
    if(states == 0)
       states = 1;
+   if ((std::numeric_limits<std::ptrdiff_t>::max)() / states < states)
+   {
+      max_state_count = (std::min)((std::ptrdiff_t)BOOST_REGEX_MAX_STATE_COUNT, (std::numeric_limits<std::ptrdiff_t>::max)() - 2);
+      return;
+   }
    states *= states;
    if((std::numeric_limits<std::ptrdiff_t>::max)() / dist < states)
    {