upstream-mirrors/gnulib
1
0
Fork 0
mirror of https://https.git.savannah.gnu.org/git/gnulib.git synced 2026-09-01 02:34:55 +00:00
Code Activity

regex: fix free_fail_stack undefined behavior

Browse Source 
* lib/regexec.c (push_fail_stack): Don’t increment number of
re_fail_stack_t entries until after successful allocation.  This
prevents a crash if re_realloc or re_malloc fails here, and a
later free_fail_stack examines regs or a later pop_fail_stack
examines node.  Problem discovered by Coverity scan sent
2022-03-11 11:03:52Z.
This commit is contained in:
Paul Eggert
2022-03-11 13:27:33 -08:00
committed by Bruno Haible
parent 20ed97afc3
commit 46178509bc
2 changed files with 13 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ChangeLog
+10
View File
@@ -1,3 +1,13 @@
2022-03-11 Paul Eggert <eggert@cs.ucla.edu>
regex: fix free_fail_stack undefined behavior
* lib/regexec.c (push_fail_stack): Don’t increment number of
re_fail_stack_t entries until after successful allocation. This
prevents a crash if re_realloc or re_malloc fails here, and a
later free_fail_stack examines regs or a later pop_fail_stack
examines node. Problem discovered by Coverity scan sent
2022-03-11 11:03:52Z.
2022-03-01 Paul Eggert <eggert@cs.ucla.edu>
Create lib/Makefile.am after gnulib-comp.m4
lib/regexec.c
+3 -2
View File
@@ -1308,8 +1308,8 @@ push_fail_stack (struct re_fail_stack_t *fs, Idx str_idx, Idx dest_node,
re_node_set *eps_via_nodes)
{
reg_errcode_t err;
Idx num = fs->num++;
if (fs->num == fs->alloc)
Idx num = fs->num;
if (num + 1 == fs->alloc)
{
struct re_fail_stack_ent_t *new_array;
new_array = re_realloc (fs->stack, struct re_fail_stack_ent_t,
@@ -1324,6 +1324,7 @@ push_fail_stack (struct re_fail_stack_t *fs, Idx str_idx, Idx dest_node,
fs->stack[num].regs = re_malloc (regmatch_t, 2 * nregs);
if (fs->stack[num].regs == NULL)
return REG_ESPACE;
fs->num = num + 1;
memcpy (fs->stack[num].regs, regs, sizeof (regmatch_t) * nregs);
memcpy (fs->stack[num].regs + nregs, prevregs, sizeof (regmatch_t) * nregs);
err = re_node_set_init_copy (&fs->stack[num].eps_via_nodes, eps_via_nodes);