(xerces-c) branch xerces-3.3 updated: XERCESC-2268 - Regexp parser should bound cardinality

This is an automated email from the ASF dual-hosted git repository.

asf-gitbox-commits pushed a commit to branch xerces-3.3
in repository https://gitbox.apache.org/repos/asf/xerces-c.git


The following commit(s) were added to refs/heads/xerces-3.3 by this push:
     new 5a5bc2b85 XERCESC-2268 - Regexp parser should bound cardinality
5a5bc2b85 is described below

commit 5a5bc2b8581806c35052c523d95efeaf21c122ca
Author: Scott Cantor <[email protected]>
AuthorDate: Thu Aug 13 12:56:31 2026 -0400

    XERCESC-2268 - Regexp parser should bound cardinality
    
    https://issues.apache.org/jira/browse/XERCESC-2268
---
 src/xercesc/util/regx/RegularExpression.hpp | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/xercesc/util/regx/RegularExpression.hpp b/src/xercesc/util/regx/RegularExpression.hpp
index 6133ebd81..4cee6c7f9 100644
--- a/src/xercesc/util/regx/RegularExpression.hpp
+++ b/src/xercesc/util/regx/RegularExpression.hpp
@@ -25,6 +25,7 @@
 // ---------------------------------------------------------------------------
 //  Includes
 // ---------------------------------------------------------------------------
+#include <xercesc/util/IllegalArgumentException.hpp>
 #include <xercesc/util/RefArrayVectorOf.hpp>
 #include <xercesc/util/XMLString.hpp>
 #include <xercesc/util/Janitor.hpp>
@@ -43,6 +44,8 @@ class RangeToken;
 class Match;
 class RegxParser;
 
+#define XERCESC_REGX_QUANTIFIER_LIMIT 1000000
+
 /**
  * The RegularExpression class represents a parsed executable regular expression.
  * This class is thread safe. Two similar regular expression syntaxes are
@@ -699,6 +702,10 @@ protected:
       int    min      = token->getMin();
       int    max      = token->getMax();
 
+      if (max > XERCESC_REGX_QUANTIFIER_LIMIT) {
+        ThrowXMLwithMemMgr(IllegalArgumentException, XMLExcepts::Regex_NotSupported, fMemoryManager);
+      }
+
       if (min >= 0 && min == max) {
 
           ret = next;