picnoir/glibc
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

regex: fix read overrun [BZ #24114]

Browse source 
Problem found by AddressSanitizer, reported by Hongxu Chen in:
https://debbugs.gnu.org/34140
* posix/regexec.c (proceed_next_node):
Do not read past end of input buffer.
This commit is contained in:
Paul Eggert 2019-01-21 11:08:13 -08:00
parent 2bac7daa58
commit 583dd860d5
2 changed files with 13 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
ChangeLog
View file

@ -1,3 +1,11 @@
2019-01-31 Paul Eggert <eggert@cs.ucla.edu>
regex: fix read overrun [BZ #24114]
Problem found by AddressSanitizer, reported by Hongxu Chen in:
https://debbugs.gnu.org/34140
* posix/regexec.c (proceed_next_node):
Do not read past end of input buffer.
2019-01-31 Florian Weimer <fweimer@redhat.com>
[BZ #24059]
@ -18002,7 +18010,7 @@
(CFLAGS-wcstof_l.c): Likewise.
(CPPFLAGS-tst-wchar-h.c): Likewise.
(CPPFLAGS-wcstold_l.c): Likewise.
---
2017-12-11 Paul A. Clarke <pc@us.ibm.com>
* sysdeps/ieee754/flt-32/s_cosf.c: New implementation.

6
posix/regexec.c
View file

@ -1293,8 +1293,10 @@ proceed_next_node (const re_match_context_t *mctx, Idx nregs, regmatch_t *regs,
else if (naccepted)
{
char *buf = (char *) re_string_get_buffer (&mctx->input);
if (memcmp (buf + regs[subexp_idx].rm_so, buf + *pidx,
naccepted) != 0)
if (mctx->input.valid_len - *pidx < naccepted
|| (memcmp (buf + regs[subexp_idx].rm_so, buf + *pidx,
naccepted)
!= 0))
return -1;
}
}