another buffer underflow segfault in regexec(3)

2016-05-15 Thread Ingo Schwarze
Hi, there is another segfault in regexec(3), engine.c, backref(), similar to the one i just reported, with the following difference: The first elementary atom in the expression must be "[[:<:]]" or "\<" rather than '^'. The condition screwing up is: case OBOW: if (( (sp =

buffer underflow segfault in regexec(3)

2016-05-15 Thread Ingo Schwarze
Hi, while studying martijn@'s pending regexec(3) patch, i found a read-access one-byte buffer underflow in "case OBOL" in the function backref(), file libc/regex/engine.c. I think outright bugs (like crashes) ought to be fixed before improving functionality. So i'd like to get this in first, the