[PATCH] lib-regex: Limit number of capture groups correctly
authorAki Tuomi <aki.tuomi@open-xchange.com>
Mon, 22 Dec 2025 20:01:18 +0000 (22:01 +0200)
committerNoah Meyerhans <noahm@debian.org>
Wed, 4 Feb 2026 16:09:21 +0000 (11:09 -0500)
We create at maximum max_capture_groups match groups.

Gbp-Pq: Name lib-regex_Limit_number_of_capture_groups_correctly.patch

src/lib-regex/regex.c

index 5ccf9d54bedad4f33f40e1d3f2c238531bf09009..d48b48adf3314137bd3febf0667755423afad590 100644 (file)
@@ -336,12 +336,9 @@ int dregex_code_match_groups(struct dregex_code *code, const char *subject,
 
        T_BEGIN {
                pcre2_match_data *mdata =
-                       pcre2_match_data_create_from_pattern(code->pat, code->gctx);
+                       pcre2_match_data_create(code->max_capture_groups, code->gctx);
                ret = dregex_code_match_int(code, subject, mdata, error_r);
-               /* Avoid extracting way too many capture groups */
-               if (ret > (int)code->max_capture_groups + 1)
-                       ret = handle_error(PCRE2_ERROR_TOO_MANY_CAPTURES, error_r);
-               else if (ret > 1) {
+               if (ret > 1) {
                        bool skip_empty = HAS_ALL_BITS(code->flags, DREGEX_NO_EMPTY_SUB);
                        /* ret is number of groups */
                        extract_matches((uint32_t)ret, mdata, skip_empty, groups_r);