svn commit: r300963 - stable/10/lib/libc/regex

[Pedro F. Giffuni]

Author: pfg
Date: Sun May 29 16:32:21 2016
New Revision: 300963
URL: https://svnweb.freebsd.org/changeset/base/300963

Log:
  MFC r300378:
  libc/regex: fix two buffer underruns.
  
  Fix some rather complex regex issues found on OpenBSD as part of some
  ongoing work to fix a sed(1) bug.
  
  Curiously the OpenBSD tests don't trigger segfaults on FreeBSD but the
  bugs were confirmed by running a port of FreeBSD's regex under OpenBSD's
  malloc. Huge thanks to Ingo for confirming the behavior.
  
  Obtained from:        OpenBSD (CVS 1.20, 1.21)

Modified:
  stable/10/lib/libc/regex/engine.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/lib/libc/regex/engine.c
==============================================================================
--- stable/10/lib/libc/regex/engine.c   Sun May 29 16:22:29 2016        
(r300962)
+++ stable/10/lib/libc/regex/engine.c   Sun May 29 16:32:21 2016        
(r300963)
@@ -606,9 +606,9 @@ backref(struct match *m,
                                return(NULL);
                        break;
                case OBOL:
-                       if ( (sp == m->beginp && !(m->eflags&REG_NOTBOL)) ||
-                                       (sp < m->endp && *(sp-1) == '\n' &&
-                                               (m->g->cflags&REG_NEWLINE)) )
+                       if ((sp == m->beginp && !(m->eflags&REG_NOTBOL)) ||
+                           (sp > m->offp && sp < m->endp &&
+                           *(sp-1) == '\n' && (m->g->cflags&REG_NEWLINE)))
                                { /* yes */ }
                        else
                                return(NULL);
@@ -622,12 +622,9 @@ backref(struct match *m,
                                return(NULL);
                        break;
                case OBOW:
-                       if (( (sp == m->beginp && !(m->eflags&REG_NOTBOL)) ||
-                                       (sp < m->endp && *(sp-1) == '\n' &&
-                                               (m->g->cflags&REG_NEWLINE)) ||
-                                       (sp > m->beginp &&
-                                                       !ISWORD(*(sp-1))) ) &&
-                                       (sp < m->endp && ISWORD(*sp)) )
+                       if (sp < m->endp && ISWORD(*sp) &&
+                           ((sp == m->beginp && !(m->eflags&REG_NOTBOL)) ||
+                           (sp > m->offp && !ISWORD(*(sp-1)))))
                                { /* yes */ }
                        else
                                return(NULL);
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"