libc/regex: fix two buffer underruns.
Fix some rather complex regex issues found on OpenBSD as part of some ongoing work to fix a sed(1) bug. Curiously the OpenBSD tests don't trigger segfaults on FreeBSD but the bugs were confirmed by running a port of FreeBSD's regex under OpenBSD's malloc. Huge thanks to Ingo for confirming the behavior. Taken from: Ingo Schwarze (through openbsd-tech 2016-05-15) MFC after: 1 week
This commit is contained in:
parent
c515200599
commit
e9fe9edde7
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=300378
@ -606,9 +606,9 @@ backref(struct match *m,
|
||||
return(NULL);
|
||||
break;
|
||||
case OBOL:
|
||||
if ( (sp == m->beginp && !(m->eflags®_NOTBOL)) ||
|
||||
(sp < m->endp && *(sp-1) == '\n' &&
|
||||
(m->g->cflags®_NEWLINE)) )
|
||||
if ((sp == m->beginp && !(m->eflags®_NOTBOL)) ||
|
||||
(sp > m->offp && sp < m->endp &&
|
||||
*(sp-1) == '\n' && (m->g->cflags®_NEWLINE)))
|
||||
{ /* yes */ }
|
||||
else
|
||||
return(NULL);
|
||||
@ -622,12 +622,9 @@ backref(struct match *m,
|
||||
return(NULL);
|
||||
break;
|
||||
case OBOW:
|
||||
if (( (sp == m->beginp && !(m->eflags®_NOTBOL)) ||
|
||||
(sp < m->endp && *(sp-1) == '\n' &&
|
||||
(m->g->cflags®_NEWLINE)) ||
|
||||
(sp > m->beginp &&
|
||||
!ISWORD(*(sp-1))) ) &&
|
||||
(sp < m->endp && ISWORD(*sp)) )
|
||||
if (sp < m->endp && ISWORD(*sp) &&
|
||||
((sp == m->beginp && !(m->eflags®_NOTBOL)) ||
|
||||
(sp > m->offp && !ISWORD(*(sp-1)))))
|
||||
{ /* yes */ }
|
||||
else
|
||||
return(NULL);
|
||||
|
Loading…
Reference in New Issue
Block a user