diff options
| author | pfg <pfg@FreeBSD.org> | 2016-05-21 19:54:10 +0000 |
|---|---|---|
| committer | pfg <pfg@FreeBSD.org> | 2016-05-21 19:54:10 +0000 |
| commit | 27a317090771252c089acad12a67d26183eb1b5c (patch) | |
| tree | 931d5284189b667eafa659463c41ab1c86f257d5 | |
| parent | 334d424627d50cc4cc73e73954534e23a1f91168 (diff) | |
| download | FreeBSD-src-27a317090771252c089acad12a67d26183eb1b5c.zip FreeBSD-src-27a317090771252c089acad12a67d26183eb1b5c.tar.gz | |
libc/regex: fix two buffer underruns.
Fix some rather complex regex issues found on OpenBSD as part of some
ongoing work to fix a sed(1) bug.
Curiously the OpenBSD tests don't trigger segfaults on FreeBSD but the
bugs were confirmed by running a port of FreeBSD's regex under OpenBSD's
malloc. Huge thanks to Ingo for confirming the behavior.
Taken from: Ingo Schwarze (through openbsd-tech 2016-05-15)
MFC after: 1 week
| -rw-r--r-- | lib/libc/regex/engine.c | 15 |
1 files changed, 6 insertions, 9 deletions
diff --git a/lib/libc/regex/engine.c b/lib/libc/regex/engine.c index 77baa7e..d3affb9 100644 --- a/lib/libc/regex/engine.c +++ b/lib/libc/regex/engine.c @@ -606,9 +606,9 @@ backref(struct match *m, return(NULL); break; case OBOL: - if ( (sp == m->beginp && !(m->eflags®_NOTBOL)) || - (sp < m->endp && *(sp-1) == '\n' && - (m->g->cflags®_NEWLINE)) ) + if ((sp == m->beginp && !(m->eflags®_NOTBOL)) || + (sp > m->offp && sp < m->endp && + *(sp-1) == '\n' && (m->g->cflags®_NEWLINE))) { /* yes */ } else return(NULL); @@ -622,12 +622,9 @@ backref(struct match *m, return(NULL); break; case OBOW: - if (( (sp == m->beginp && !(m->eflags®_NOTBOL)) || - (sp < m->endp && *(sp-1) == '\n' && - (m->g->cflags®_NEWLINE)) || - (sp > m->beginp && - !ISWORD(*(sp-1))) ) && - (sp < m->endp && ISWORD(*sp)) ) + if (sp < m->endp && ISWORD(*sp) && + ((sp == m->beginp && !(m->eflags®_NOTBOL)) || + (sp > m->offp && !ISWORD(*(sp-1))))) { /* yes */ } else return(NULL); |
