From 74653565242af2be688aa0532b2b176631380cbe Mon Sep 17 00:00:00 2001 From: pfg Date: Sun, 29 May 2016 16:32:21 +0000 Subject: MFC r300378: libc/regex: fix two buffer underruns. Fix some rather complex regex issues found on OpenBSD as part of some ongoing work to fix a sed(1) bug. Curiously the OpenBSD tests don't trigger segfaults on FreeBSD but the bugs were confirmed by running a port of FreeBSD's regex under OpenBSD's malloc. Huge thanks to Ingo for confirming the behavior. Obtained from: OpenBSD (CVS 1.20, 1.21) --- lib/libc/regex/engine.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) (limited to 'lib/libc/regex/engine.c') diff --git a/lib/libc/regex/engine.c b/lib/libc/regex/engine.c index 72922f6..2ca971b 100644 --- a/lib/libc/regex/engine.c +++ b/lib/libc/regex/engine.c @@ -606,9 +606,9 @@ backref(struct match *m, return(NULL); break; case OBOL: - if ( (sp == m->beginp && !(m->eflags®_NOTBOL)) || - (sp < m->endp && *(sp-1) == '\n' && - (m->g->cflags®_NEWLINE)) ) + if ((sp == m->beginp && !(m->eflags®_NOTBOL)) || + (sp > m->offp && sp < m->endp && + *(sp-1) == '\n' && (m->g->cflags®_NEWLINE))) { /* yes */ } else return(NULL); @@ -622,12 +622,9 @@ backref(struct match *m, return(NULL); break; case OBOW: - if (( (sp == m->beginp && !(m->eflags®_NOTBOL)) || - (sp < m->endp && *(sp-1) == '\n' && - (m->g->cflags®_NEWLINE)) || - (sp > m->beginp && - !ISWORD(*(sp-1))) ) && - (sp < m->endp && ISWORD(*sp)) ) + if (sp < m->endp && ISWORD(*sp) && + ((sp == m->beginp && !(m->eflags®_NOTBOL)) || + (sp > m->offp && !ISWORD(*(sp-1))))) { /* yes */ } else return(NULL); -- cgit v1.1