]> Savannah Git Hosting - gnulib.git/commitdiff
regex: fix integer-overflow bug in never-used code
authorPaul Eggert <eggert@cs.ucla.edu>
Fri, 16 Dec 2016 17:34:02 +0000 (09:34 -0800)
committerPaul Eggert <eggert@cs.ucla.edu>
Fri, 16 Dec 2016 17:34:31 +0000 (09:34 -0800)
Problem reported by Clément Pit–Claudel in:
http://lists.gnu.org/archive/html/emacs-devel/2016-12/msg00654.html
* lib/regex_internal.h: Include intprops.h.
* lib/regexec.c (re_search_2_stub): Use it to avoid undefined
behavior on integer overflow.
* modules/regex (Depends-on): Add intprops.

ChangeLog
lib/regex_internal.h
lib/regexec.c
modules/regex

index dd67dba44e8ef49b1dac4191d5d1a8d7c9c92c3a..c588296342af5e05bf3d9c8ea062b9c63836cb8b 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,13 @@
 2016-12-16  Paul Eggert  <eggert@cs.ucla.edu>
 
+       regex: fix integer-overflow bug in never-used code
+       Problem reported by Clément Pit–Claudel in:
+       http://lists.gnu.org/archive/html/emacs-devel/2016-12/msg00654.html
+       * lib/regex_internal.h: Include intprops.h.
+       * lib/regexec.c (re_search_2_stub): Use it to avoid undefined
+       behavior on integer overflow.
+       * modules/regex (Depends-on): Add intprops.
+
        fpending: fix port to MinGW on Emacs
        * lib/stdio-impl.h [__MINGW32__]: Do not include errno.h.
        Problem reported by Eli Zaretskii in:
index 56a315a4f7db24ee3ea89a2b7986e67c7179adf0..7ac5f9267139edcf49b44edafd5ae35217e546e5 100644 (file)
@@ -33,6 +33,8 @@
 #include <stdbool.h>
 #include <stdint.h>
 
+#include "intprops.h"
+
 #ifdef _LIBC
 # include <libc-lock.h>
 # define lock_define(name) __libc_lock_define (, name)
index afdc1737b86c97978df2b6c29dac3bc845b510f2..f1e61afc413ec1db6d953507319815db0539bb18 100644 (file)
@@ -354,10 +354,12 @@ re_search_2_stub (struct re_pattern_buffer *bufp, const char *string1,
 {
   const char *str;
   regoff_t rval;
-  Idx len = length1 + length2;
+  Idx len;
   char *s = NULL;
 
-  if (BE (length1 < 0 || length2 < 0 || stop < 0 || len < length1, 0))
+  if (BE ((length1 < 0 || length2 < 0 || stop < 0
+           || INT_ADD_WRAPV (length1, length2, &len)),
+          0))
     return -2;
 
   /* Concatenate the strings.  */
index c5ae1b255fab26f9e2891dba846b70b5aac39500..e1c9b5887bc2c49019e9cd2efcd26c90270db635 100644 (file)
@@ -18,6 +18,7 @@ ssize_t
 alloca-opt      [test $ac_use_included_regex = yes]
 btowc           [test $ac_use_included_regex = yes]
 gettext-h       [test $ac_use_included_regex = yes]
+intprops        [test $ac_use_included_regex = yes]
 lock      [test "$ac_cv_gnu_library_2_1:$ac_use_included_regex" = no:yes]
 memcmp          [test $ac_use_included_regex = yes]
 memmove         [test $ac_use_included_regex = yes]