[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
weird value flow question
From: |
Kapus, Timotej |
Subject: |
weird value flow question |
Date: |
Sat, 3 Mar 2018 01:48:04 +0000 |
Hi,
This is a bit of a weird request for help. I'm trying to figure out if there is
a way for a value to flow from either a command line argument or a file or
stdin, to the return value of calc_state_hash in regex_internal.c . From what I
understand (which is very limited), the hash is a sum of all the elements in
the re_node_set. Those elements correspond somehow (I presume by id or
something?) to the DFA nodes. The dfa nodes, do seem to contain characters of a
regexp being matches (because re_dfa_add_tree_node adds the token to the tree
). But I failed to find an convincing relation between the DFA nodes and
re_node_set, but from the names I would assume there is one.
So to perhaps a more precise question I should be asking is what is contained
in re_node_set->elements and can it be influenced by something from the outside
of the program?
Another avenue I was looking at was trying to see where "context" comes from in
calc_state_hash and I managed to find acquire_init_state_context in
lib/regexec.c , which seems to have a path the takes "context" from an
re_string_t . That seems to be on the right path, but I don't really get the
higher level ideas of what context does here, so I get lost.
I know it's a bit of a long shoot, but I would appreciate any help with this.
Cheers,
Timotej
- weird value flow question,
Kapus, Timotej <=