pgsql: Fix assorted security-grade bugs in the regex engine. - Mailing list pgsql-committers

Log Message:
-----------
Fix assorted security-grade bugs in the regex engine.  All of these problems
are shared with Tcl, since it's their code to begin with, and the patches
have been copied from Tcl 8.5.0.  Problems:

CVE-2007-4769: Inadequate check on the range of backref numbers allows
crash due to out-of-bounds read.
CVE-2007-4772: Infinite loop in regex optimizer for pattern '($|^)*'.
CVE-2007-6067: Very slow optimizer cleanup for regex with a large NFA
representation, as well as crash if we encounter an out-of-memory condition
during NFA construction.

Part of the response to CVE-2007-6067 is to put a limit on the number of
states in the NFA representation of a regex.  This seems needed even though
the within-the-code problems have been corrected, since otherwise the code
could try to use very large amounts of memory for a suitably-crafted regex,
leading to potential DOS by driving the system into swap, activating a kernel
OOM killer, etc.

Although there are certainly plenty of ways to drive the system into effective
DOS with poorly-written SQL queries, these problems seem worth treating as
security issues because many applications might accept regex search patterns
from untrustworthy sources.

Thanks to Will Drewry of Google for reporting these problems.  Patches by Will
Drewry and Tom Lane.

Security: CVE-2007-4769, CVE-2007-4772, CVE-2007-6067

Tags:
----
REL8_2_STABLE

Modified Files:
--------------
    pgsql/src/backend/regex:
        regc_color.c (r1.5 -> r1.5.4.1)
        (http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/regex/regc_color.c?r1=1.5&r2=1.5.4.1)
        regc_lex.c (r1.5 -> r1.5.4.1)
        (http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/regex/regc_lex.c?r1=1.5&r2=1.5.4.1)
        regc_nfa.c (r1.4 -> r1.4.4.1)
        (http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/regex/regc_nfa.c?r1=1.4&r2=1.4.4.1)
    pgsql/src/include/regex:
        regerrs.h (r1.3 -> r1.3.8.1)
        (http://developer.postgresql.org/cvsweb.cgi/pgsql/src/include/regex/regerrs.h?r1=1.3&r2=1.3.8.1)
        regex.h (r1.28 -> r1.28.4.1)
        (http://developer.postgresql.org/cvsweb.cgi/pgsql/src/include/regex/regex.h?r1=1.28&r2=1.28.4.1)
        regguts.h (r1.5 -> r1.5.4.1)
        (http://developer.postgresql.org/cvsweb.cgi/pgsql/src/include/regex/regguts.h?r1=1.5&r2=1.5.4.1)