The algorithm that computes the tables used in the BM search algorithm sometimes

access an array beyond it's length. This only happens in the last iteration of
a loop, and the value fetched is not used then, so the bug is a relatively
innocent one. Fix this by not fetching any value on the last iteration of said
loop.

Submitted by:	MKI <mki@mozone.net>
MFC after:	1 week

1 files changed, 2 insertions, 1 deletions

diff --git a/lib/libc/regex/regcomp.c b/lib/libc/regex/regcomp.c
index bf92f2c..602ddb0 100644
--- a/lib/libc/regex/regcomp.c
+++ b/lib/libc/regex/regcomp.c
@@ -2045,7 +2045,8 @@ struct re_guts *g;
 			    g->mlen + ssuffix - suffix);
                         suffix++;
                 }
-                ssuffix = pmatches[ssuffix];
+		if (suffix < g->mlen)
+                	ssuffix = pmatches[ssuffix];
         }
 
 	free(pmatches);