+2022-03-11 Paul Eggert <eggert@cs.ucla.edu>
+
+ regex: fix free_fail_stack undefined behavior
+ * lib/regexec.c (push_fail_stack): Don’t increment number of
+ re_fail_stack_t entries until after successful allocation. This
+ prevents a crash if re_realloc or re_malloc fails here, and a
+ later free_fail_stack examines regs or a later pop_fail_stack
+ examines node. Problem discovered by Coverity scan sent
+ 2022-03-11 11:03:52Z.
+
2022-03-10 Paul Eggert <eggert@cs.ucla.edu>
fts: revert change to use AT_NO_AUTOMOUNT
re_node_set *eps_via_nodes)
{
reg_errcode_t err;
- Idx num = fs->num++;
- if (fs->num == fs->alloc)
+ Idx num = fs->num;
+ if (num + 1 == fs->alloc)
{
struct re_fail_stack_ent_t *new_array;
new_array = re_realloc (fs->stack, struct re_fail_stack_ent_t,
fs->stack[num].regs = re_malloc (regmatch_t, 2 * nregs);
if (fs->stack[num].regs == NULL)
return REG_ESPACE;
+ fs->num = num + 1;
memcpy (fs->stack[num].regs, regs, sizeof (regmatch_t) * nregs);
memcpy (fs->stack[num].regs + nregs, prevregs, sizeof (regmatch_t) * nregs);
err = re_node_set_init_copy (&fs->stack[num].eps_via_nodes, eps_via_nodes);