regex: fix buffer read overrrun
authorPaul Eggert <eggert@cs.ucla.edu>
Mon, 18 Oct 2021 21:50:16 +0000 (14:50 -0700)
committerPaul Eggert <eggert@cs.ucla.edu>
Mon, 18 Oct 2021 21:52:55 +0000 (14:52 -0700)
* config/srclist.txt: Remove posix/regexec.c for now.
* lib/regexec.c (re_search_internal):
Fix buffer read overrun reported by Benno Schulenberg in:
https://lists.gnu.org/r/bug-gnulib/2021-10/msg00035.html

ChangeLog
config/srclist.txt
lib/regexec.c

index 87fd99f6a46261d051c29c03457dc50ade6a8e2c..a017453dc73e6b62482b2c98f009c1edec55f229 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2021-10-18  Paul Eggert  <eggert@cs.ucla.edu>
+
+       regex: fix buffer read overrrun
+       * lib/regexec.c (re_search_internal):
+       Fix buffer read overrun reported by Benno Schulenberg in:
+       https://lists.gnu.org/r/bug-gnulib/2021-10/msg00035.html
+
 2021-10-15  Paul Eggert  <eggert@cs.ucla.edu>
 
        nproc: port better to macOS 10.14
index 16b61721aa173343f7e6bb01352bc848ab86502f..83e251def97eb6b1dc039bfd943e1fc9227289aa 100644 (file)
@@ -70,7 +70,7 @@ $LIBCSRC posix/regex.c                        lib
 $LIBCSRC posix/regex.h                 lib
 $LIBCSRC posix/regex_internal.c                lib
 $LIBCSRC posix/regex_internal.h                lib
-$LIBCSRC posix/regexec.c               lib
+#$LIBCSRC posix/regexec.c              lib
 #$LIBCSRC stdlib/canonicalize           lib/canonicalize-lgpl.c
 #$LIBCSRC sysdeps/generic/eloop-threshold.h    lib
 $LIBCSRC time/timegm.c                 lib
index 83e9aaf8cad956a28b545f9c5c98c0ebb607a7b2..a955aa218251ac1128328745376d7533f103978e 100644 (file)
@@ -760,7 +760,7 @@ re_search_internal (const regex_t *preg, const char *string, Idx length,
                }
              /* If MATCH_FIRST is out of the buffer, leave it as '\0'.
                 Note that MATCH_FIRST must not be smaller than 0.  */
-             ch = (match_first >= length
+             ch = (mctx.input.valid_len <= offset
                    ? 0 : re_string_byte_at (&mctx.input, offset));
              if (fastmap[ch])
                break;