diff options
| author | brooks <brooks@FreeBSD.org> | 2017-05-09 16:29:06 +0000 |
|---|---|---|
| committer | brooks <brooks@FreeBSD.org> | 2017-05-09 16:29:06 +0000 |
| commit | cd8758a009b5932c800b7cbfd44fdf25e3ffe6ff (patch) | |
| tree | 82c349ea23ccde27eb48c5f403c39a2756d6b309 /lib/libc/regex | |
| parent | f128b08e8ab27e4184248943629484a42900ff08 (diff) | |
| download | FreeBSD-src-cd8758a009b5932c800b7cbfd44fdf25e3ffe6ff.zip FreeBSD-src-cd8758a009b5932c800b7cbfd44fdf25e3ffe6ff.tar.gz | |
MFC r317707:
Correct an out-of-bounds read in regcomp when the RE is bad.
When passed the invalid regular expression "a**", the error is
eventually detected and seterr() is called. It sets p->error
appropriatly and p->next and p->end to nuls which is a never used char
nuls[10] which is zeros due to .bss initialization. Unfortunatly,
p_ere_exp() and p_simp_re() both have fall through cases where they set
the error, decrement p->next and access it which means a read from
whatever .bss variable comes before nuls.
Found with regex_test:repet_multi and CHERI bounds checking.
Reviewed by: ngie, pfg, emaste
Obtained from: CheriBSD
Sponsored by: DARPA, AFRL
Differential Revision: https://reviews.freebsd.org/D10541
Diffstat (limited to 'lib/libc/regex')
| -rw-r--r-- | lib/libc/regex/regcomp.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/lib/libc/regex/regcomp.c b/lib/libc/regex/regcomp.c index 9211f65..1e231fb 100644 --- a/lib/libc/regex/regcomp.c +++ b/lib/libc/regex/regcomp.c @@ -444,6 +444,8 @@ p_ere_exp(struct parse *p) (void)REQUIRE(!MORE() || !isdigit((uch)PEEK()), REG_BADRPT); /* FALLTHROUGH */ default: + if (p->error != 0) + return; p->next--; wc = WGETNEXT(); ordinary(p, wc); @@ -651,6 +653,8 @@ p_simp_re(struct parse *p, (void)REQUIRE(starordinary, REG_BADRPT); /* FALLTHROUGH */ default: + if (p->error != 0) + return(0); /* Definitely not $... */ p->next--; wc = WGETNEXT(); ordinary(p, wc); |
