diff options
| author | tjr <tjr@FreeBSD.org> | 2004-11-21 03:14:32 +0000 |
|---|---|---|
| committer | tjr <tjr@FreeBSD.org> | 2004-11-21 03:14:32 +0000 |
| commit | 1f410c73aaa09f0990f20a0fe3c1ecb1af7c352b (patch) | |
| tree | 0a52685b18c72c56999264a3b962a49f3ff6dd7a /lib/libc/regex | |
| parent | 0ccf8f0d91983e1b1776337c46298c297124262f (diff) | |
| download | FreeBSD-src-1f410c73aaa09f0990f20a0fe3c1ecb1af7c352b.zip FreeBSD-src-1f410c73aaa09f0990f20a0fe3c1ecb1af7c352b.tar.gz | |
Fix computation of the 'n' argument to mbrtowc (through XMBRTOWC) to avoid
reading past 'stop' in various places when converting multibyte characters.
Reading too far caused truncation to not be detected when it should have
been, eventually causing regexec() to loop infinitely in with certain
combinations of patterns and strings in multibyte locales.
PR: 74020
MFC after: 4 weeks
Diffstat (limited to 'lib/libc/regex')
| -rw-r--r-- | lib/libc/regex/engine.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/lib/libc/regex/engine.c b/lib/libc/regex/engine.c index e6484ef..f97a79b 100644 --- a/lib/libc/regex/engine.c +++ b/lib/libc/regex/engine.c @@ -331,7 +331,7 @@ int eflags; NOTE("false alarm"); /* recycle starting later */ start = m->coldp + XMBRTOWC(NULL, m->coldp, - m->endp - m->coldp, &m->mbs, 0); + stop - m->coldp, &m->mbs, 0); assert(start <= stop); } @@ -807,7 +807,7 @@ sopno stopst; if (p == m->endp) c = OUT; else - clen = XMBRTOWC(&c, p, m->endp - p, &m->mbs, BADCHAR); + clen = XMBRTOWC(&c, p, stop - p, &m->mbs, BADCHAR); if (EQ(st, fresh)) coldp = p; @@ -861,7 +861,7 @@ sopno stopst; assert(coldp != NULL); m->coldp = coldp; if (ISSET(st, stopst)) - return(p+XMBRTOWC(NULL, p, m->endp - p, &m->mbs, 0)); + return(p+XMBRTOWC(NULL, p, stop - p, &m->mbs, 0)); else return(NULL); } @@ -913,7 +913,7 @@ sopno stopst; c = OUT; clen = 0; } else - clen = XMBRTOWC(&c, p, m->endp - p, &m->mbs, BADCHAR); + clen = XMBRTOWC(&c, p, stop - p, &m->mbs, BADCHAR); /* is there an EOL and/or BOL between lastc and c? */ flagch = '\0'; |
