diff options
| author | brooks <brooks@FreeBSD.org> | 2017-05-09 16:27:20 +0000 |
|---|---|---|
| committer | brooks <brooks@FreeBSD.org> | 2017-05-09 16:27:20 +0000 |
| commit | d1c5218b098101b458b1362327aa5dc754eefcf2 (patch) | |
| tree | 0d3ddfdf773828f0d0bff94a0e0de3b5672c7aae /lib/libc/regex/regcomp.c | |
| parent | b5b8ec81d73f98f3cce4fde5c68798bf1cae65aa (diff) | |
| download | FreeBSD-src-d1c5218b098101b458b1362327aa5dc754eefcf2.zip FreeBSD-src-d1c5218b098101b458b1362327aa5dc754eefcf2.tar.gz | |
MFC r317707:
Correct an out-of-bounds read in regcomp when the RE is bad.
When passed the invalid regular expression "a**", the error is
eventually detected and seterr() is called. It sets p->error
appropriatly and p->next and p->end to nuls which is a never used char
nuls[10] which is zeros due to .bss initialization. Unfortunatly,
p_ere_exp() and p_simp_re() both have fall through cases where they set
the error, decrement p->next and access it which means a read from
whatever .bss variable comes before nuls.
Found with regex_test:repet_multi and CHERI bounds checking.
Reviewed by: ngie, pfg, emaste
Obtained from: CheriBSD
Sponsored by: DARPA, AFRL
Differential Revision: https://reviews.freebsd.org/D10541
Diffstat (limited to 'lib/libc/regex/regcomp.c')
| -rw-r--r-- | lib/libc/regex/regcomp.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/lib/libc/regex/regcomp.c b/lib/libc/regex/regcomp.c index dfb02c6..b9e67c6 100644 --- a/lib/libc/regex/regcomp.c +++ b/lib/libc/regex/regcomp.c @@ -444,6 +444,8 @@ p_ere_exp(struct parse *p) (void)REQUIRE(!MORE() || !isdigit((uch)PEEK()), REG_BADRPT); /* FALLTHROUGH */ default: + if (p->error != 0) + return; p->next--; wc = WGETNEXT(); ordinary(p, wc); @@ -651,6 +653,8 @@ p_simp_re(struct parse *p, (void)REQUIRE(starordinary, REG_BADRPT); /* FALLTHROUGH */ default: + if (p->error != 0) + return(0); /* Definitely not $... */ p->next--; wc = WGETNEXT(); ordinary(p, wc); |
