altoffset() always returned whenever it recursed, because at the end

of the processing of the recursion, "scan" would be pointing to O_CH
(or O_QUEST), which would then be interpreted as being the end character
for altoffset().

We avoid this by properly increasing scan before leaving the switch.

Without this, something like (a?b?)?cc would result in a g->moffset of
1 instead of 2.

I added a case to the soon-to-be-imported regex(3) test code to catch
this error.

1 files changed, 4 insertions, 0 deletions

diff --git a/lib/libc/regex/regcomp.c b/lib/libc/regex/regcomp.c
index e0afdcc..bf92f2c 100644
--- a/lib/libc/regex/regcomp.c
+++ b/lib/libc/regex/regcomp.c
@@ -1891,6 +1891,10 @@ int mccs;
 							OP(s) != OOR2)
 					return -1;
 			} while (OP(s) != O_QUEST && OP(s) != O_CH);
+			/* We must skip to the next position, or we'll
+			 * leave altoffset() too early.
+			 */
+			scan++;
 			break;
 		case OANYOF:
 			if (mccs)