diff options
| author | dim <dim@FreeBSD.org> | 2016-08-09 19:20:53 +0000 |
|---|---|---|
| committer | dim <dim@FreeBSD.org> | 2016-08-09 19:20:53 +0000 |
| commit | 521ece6e40b5f36b511d428e34547d4d4c92104c (patch) | |
| tree | 0bfc69f80a1974a61e186042b3520edfde3972cb /usr.bin/grep | |
| parent | 8ccb5f4eb3579be38a0227b8398806e8b1681360 (diff) | |
| download | FreeBSD-src-521ece6e40b5f36b511d428e34547d4d4c92104c.zip FreeBSD-src-521ece6e40b5f36b511d428e34547d4d4c92104c.tar.gz | |
MFC r303676:
Fix a segfault in bsdgrep when parsing the invalid extended regexps "?"
or "+" (these are invalid, because there is no preceding operand).
When bsdgrep attempts to emulate GNU grep in discarding and ignoring the
invalid ? or + operators, some later logic in tre_compile_fast() goes
beyond the end of the buffer, leading to a crash.
Fix this by bailing out, and reporting a bad pattern instead.
Approved by: re (gjb, kib)
Reported by: Steve Kargl
Diffstat (limited to 'usr.bin/grep')
| -rw-r--r-- | usr.bin/grep/regex/tre-fastmatch.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/usr.bin/grep/regex/tre-fastmatch.c b/usr.bin/grep/regex/tre-fastmatch.c index 0881c55..08e17c7 100644 --- a/usr.bin/grep/regex/tre-fastmatch.c +++ b/usr.bin/grep/regex/tre-fastmatch.c @@ -621,7 +621,7 @@ tre_compile_fast(fastmatch_t *fg, const tre_char_t *pat, size_t n, case TRE_CHAR('+'): case TRE_CHAR('?'): if ((cflags & REG_EXTENDED) && (i == 0)) - continue; + goto badpat; else if ((cflags & REG_EXTENDED) ^ !escaped) STORE_CHAR; else |
