MdeModulePkg/RegularExpressionDxe: Miss null pointer check

Oniguruma https://github.com/kkos/oniguruma
this change is merged from oniguruma develop branch.
from commit ea36d810f1d9b28f3ef20bd8d453bea2f7fb598b

Cc: Liming Gao <liming.gao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Dongao Guo <dongao.guo@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>

diff --git a/MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma/regenc.h b/MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma/regenc.h
index 6235520a1ed641f277f1324bec7a7a2b687a239c..46a51421e9a811400e7ebdb9348ad6d025de75f5 100644 (file)
--- a/MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma/regenc.h
+++ b/MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma/regenc.h
@@ -197,7 +197,7 @@ extern int onigenc_egcb_is_break_position P_((OnigEncoding enc, UChar* p, UChar*
   else if ((buk)->fold_len == 3)\\r
     addr = OnigUnicodeFolds3 + (buk)->index;\\r
   else\\r
-    addr = 0;\\r
+    return ONIGERR_INVALID_CODE_POINT_VALUE;\\r
 } while (0)\r
 \r
 extern OnigCodePoint OnigUnicodeFolds1[];\r

diff --git a/MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma/regparse.c b/MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma/regparse.c
index 6033d2166b9154a0f29cf3dd8a3f5c0ebf58801b..5b7fec99e2e374f7142c01c40e573af1e46778e4 100644 (file)
--- a/MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma/regparse.c
+++ b/MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma/regparse.c
@@ -966,6 +966,7 @@ name_add(regex_t* reg, UChar* name, UChar* name_end, int backref, ScanEnv* env)
 #ifdef USE_ST_LIBRARY\r
     if (IS_NULL(t)) {\r
       t = onig_st_init_strend_table_with_size(INIT_NAMES_ALLOC_NUM);\r
+      CHECK_NULL_RETURN_MEMERR(t);\r
       reg->name_table = (void* )t;\r
     }\r
     e = (NameEntry* )xmalloc(sizeof(NameEntry));\r
@@ -1372,6 +1373,7 @@ callout_name_entry(CalloutNameEntry** rentry, OnigEncoding enc,
 #ifdef USE_ST_LIBRARY\r
     if (IS_NULL(t)) {\r
       t = onig_st_init_callout_name_table_with_size(INIT_NAMES_ALLOC_NUM);\r
+      CHECK_NULL_RETURN_MEMERR(t);\r
       GlobalCalloutNameTable = t;\r
     }\r
     e = (CalloutNameEntry* )xmalloc(sizeof(CalloutNameEntry));\r
@@ -1616,6 +1618,7 @@ onig_get_callout_start_func(regex_t* reg, int callout_num)
   CalloutListEntry* e;\r
 \r
   e = onig_reg_callout_list_at(reg, callout_num);\r
+  CHECK_NULL_RETURN(e);\r
   return e->start_func;\r
 }\r
 \r
@@ -1623,6 +1626,7 @@ extern const UChar*
 onig_get_callout_tag_start(regex_t* reg, int callout_num)\r
 {\r
   CalloutListEntry* e = onig_reg_callout_list_at(reg, callout_num);\r
+  CHECK_NULL_RETURN(e);\r
   return e->tag_start;\r
 }\r
 \r
@@ -1630,6 +1634,7 @@ extern const UChar*
 onig_get_callout_tag_end(regex_t* reg, int callout_num)\r
 {\r
   CalloutListEntry* e = onig_reg_callout_list_at(reg, callout_num);\r
+  CHECK_NULL_RETURN(e);\r
   return e->tag_end;\r
 }\r
 \r
@@ -1904,6 +1909,7 @@ callout_tag_entry(regex_t* reg, UChar* name, UChar* name_end,
   r = callout_tag_entry_raw(ext->tag_table, name, name_end, entry_val);\r
 \r
   e = onig_reg_callout_list_at(reg, (int )entry_val);\r
+  CHECK_NULL_RETURN_MEMERR(e);\r
   e->tag_start = name;\r
   e->tag_end   = name_end;\r
 \r
@@ -2138,6 +2144,8 @@ node_new_anychar_with_fixed_option(OnigOptionType option)
   Node* node;\r
 \r
   node = node_new_anychar();\r
+  CHECK_NULL_RETURN(node);\r
+\r
   ct = CTYPE_(node);\r
   ct->options = option;\r
   NODE_STATUS_ADD(node, FIXED_OPTION);\r
@@ -3174,6 +3182,7 @@ static Node*
 node_new_str_raw(UChar* s, UChar* end)\r
 {\r
   Node* node = node_new_str(s, end);\r
+  CHECK_NULL_RETURN(node);\r
   NODE_STRING_SET_RAW(node);\r
   return node;\r
 }\r
@@ -3206,6 +3215,7 @@ str_node_split_last_char(Node* node, OnigEncoding enc)
     p = onigenc_get_prev_char_head(enc, sn->s, sn->end);\r
     if (p && p > sn->s) { /* can be split. */\r
       rn = node_new_str(p, sn->end);\r
+      CHECK_NULL_RETURN(rn);\r
       if (NODE_STRING_IS_RAW(node))\r
         NODE_STRING_SET_RAW(rn);\r
 \r
@@ -6626,6 +6636,11 @@ parse_callout_of_contents(Node** np, int cterm, UChar** src, UChar* end, ScanEnv
   }\r
 \r
   e = onig_reg_callout_list_at(env->reg, num);\r
+  if (IS_NULL(e)) {\r
+    xfree(contents);\r
+    return ONIGERR_MEMORY;\r
+  }\r
+\r
   e->of      = ONIG_CALLOUT_OF_CONTENTS;\r
   e->in      = in;\r
   e->name_id = ONIG_NON_NAME_ID;\r
@@ -6935,6 +6950,8 @@ parse_callout_of_name(Node** np, int cterm, UChar** src, UChar* end, ScanEnv* en
   if (r != ONIG_NORMAL) return r;\r
 \r
   e = onig_reg_callout_list_at(env->reg, num);\r
+  CHECK_NULL_RETURN_MEMERR(e);\r
+\r
   e->of         = ONIG_CALLOUT_OF_NAME;\r
   e->in         = in;\r
   e->name_id    = name_id;\r
@@ -8098,6 +8115,11 @@ parse_branch(Node** top, OnigToken* tok, int term, UChar** src, UChar* end,
   }\r
   else {\r
     *top  = node_new_list(node, NULL);\r
+    if (IS_NULL(*top)) {\r
+      onig_node_free(node);\r
+      return ONIGERR_MEMORY;\r
+    }\r
+\r
     headp = &(NODE_CDR(*top));\r
     while (r != TK_EOT && r != term && r != TK_ALT) {\r
       r = parse_exp(&node, tok, term, src, end, env);\r
@@ -8133,6 +8155,7 @@ parse_subexp(Node** top, OnigToken* tok, int term, UChar** src, UChar* end,
   env->parse_depth++;\r
   if (env->parse_depth > ParseDepthLimit)\r
     return ONIGERR_PARSE_DEPTH_LIMIT_OVER;\r
+\r
   r = parse_branch(&node, tok, term, src, end, env);\r
   if (r < 0) {\r
     onig_node_free(node);\r
@@ -8144,6 +8167,11 @@ parse_subexp(Node** top, OnigToken* tok, int term, UChar** src, UChar* end,
   }\r
   else if (r == TK_ALT) {\r
     *top  = onig_node_new_alt(node, NULL);\r
+    if (IS_NULL(*top)) {\r
+      onig_node_free(node);\r
+      return ONIGERR_MEMORY;\r
+    }\r
+\r
     headp = &(NODE_CDR(*top));\r
     while (r == TK_ALT) {\r
       r = fetch_token(tok, src, end, env);\r
@@ -8154,6 +8182,12 @@ parse_subexp(Node** top, OnigToken* tok, int term, UChar** src, UChar* end,
         return r;\r
       }\r
       *headp = onig_node_new_alt(node, NULL);\r
+      if (IS_NULL(*headp)) {\r
+        onig_node_free(node);\r
+        onig_node_free(*top);\r
+        return ONIGERR_MEMORY;\r
+      }\r
+\r
       headp = &(NODE_CDR(*headp));\r
     }\r
 \r

diff --git a/MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma/unicode.c b/MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma/unicode.c
index 15875001cfd9f7d734b19f0b3560a16bfa6db982..16c34b62ce38dda10f63890a110f8d53f4f0bcc0 100644 (file)
--- a/MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma/unicode.c
+++ b/MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma/unicode.c
@@ -758,6 +758,10 @@ onig_unicode_define_user_property(const char* name, OnigCodePoint* ranges)
 \r
   if (UserDefinedPropertyTable == 0) {\r
     UserDefinedPropertyTable = onig_st_init_strend_table_with_size(10);\r
+    if (IS_NULL(UserDefinedPropertyTable)) {\r
+      xfree(s);\r
+      return ONIGERR_MEMORY;\r
+    }\r
   }\r
 \r
   e = UserDefinedPropertyRanges + UserDefinedPropertyNum;\r