Sorry about that. doxygen's pre.l uses {0,1000} on several string
patterns (lines 642, 645, 658, 668, 685), which exceeds OpenBSD's
RE_DUP_MAX at 255.
The UBSan trigger I was originally fixing is "lb - 1" wrapping when
lb is INT_MIN (sscanf("%d") clamps overflow that way on OpenBSD).
That only requires forbidding negative values, not capping at 255.
The grammars-too-large case is already caught downstream by the
"input rules are too complicated" check in mkstate().
Minimal follow-up that keeps the overflow guard but drops the cap:
Index: usr.bin/lex/nfa.c
===================================================================
RCS file: /cvs/src/usr.bin/lex/nfa.c,v
retrieving revision 1.13
diff -u -p -r1.13 nfa.c
--- usr.bin/lex/nfa.c 15 May 2026 14:24:44 -0000 1.13
+++ usr.bin/lex/nfa.c
@@ -554,9 +554,8 @@ mkrep(int mach, int lb, int ub)
{
int base_mach, tail, copy, i;
- if (lb > RE_DUP_MAX || (ub > RE_DUP_MAX &&
- ub != INFINITE_REPEAT))
- flexfatal(_("repetition value too large"));
+ if (lb < 0 || (ub < 0 && ub != INFINITE_REPEAT))
+ flexfatal(_("negative repetition value"));
base_mach = copysingl(mach, lb - 1);
Verified on amd64, i386, and arm64 against doxygen and the original
issue.
OK?
