From 521ece6e40b5f36b511d428e34547d4d4c92104c Mon Sep 17 00:00:00 2001 From: dim Date: Tue, 9 Aug 2016 19:20:53 +0000 Subject: MFC r303676: Fix a segfault in bsdgrep when parsing the invalid extended regexps "?" or "+" (these are invalid, because there is no preceding operand). When bsdgrep attempts to emulate GNU grep in discarding and ignoring the invalid ? or + operators, some later logic in tre_compile_fast() goes beyond the end of the buffer, leading to a crash. Fix this by bailing out, and reporting a bad pattern instead. Approved by: re (gjb, kib) Reported by: Steve Kargl --- usr.bin/grep/regex/tre-fastmatch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'usr.bin/grep') diff --git a/usr.bin/grep/regex/tre-fastmatch.c b/usr.bin/grep/regex/tre-fastmatch.c index 0881c55..08e17c7 100644 --- a/usr.bin/grep/regex/tre-fastmatch.c +++ b/usr.bin/grep/regex/tre-fastmatch.c @@ -621,7 +621,7 @@ tre_compile_fast(fastmatch_t *fg, const tre_char_t *pat, size_t n, case TRE_CHAR('+'): case TRE_CHAR('?'): if ((cflags & REG_EXTENDED) && (i == 0)) - continue; + goto badpat; else if ((cflags & REG_EXTENDED) ^ !escaped) STORE_CHAR; else -- cgit v1.1