freebsd-dev/lib/libc/regex
Brooks Davis 9806ef7852 Correct an out-of-bounds read in regcomp when the RE is bad.
When passed the invalid regular expression "a**", the error is
eventually detected and seterr() is called. It sets p->error
appropriatly and p->next and p->end to nuls which is a never used char
nuls[10] which is zeros due to .bss initialization. Unfortunatly,
p_ere_exp() and p_simp_re() both have fall through cases where they set
the error, decrement p->next and access it which means a read from what
ever .bss variable comes before nuls.

Found with regex_test:repet_multi and CHERI bounds checking.

Reviewed by:	ngie, pfg, emaste
Obtained from:	CheriBSD
Sponsored by:	DARPA, AFRL
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D10541
2017-05-02 21:20:27 +00:00
..
grot Replace dot-dot relative pathing with SRCTOP-relative paths where possible 2017-01-20 03:23:24 +00:00
cname.h regex: unsign and constify some variables. 2017-04-23 21:51:29 +00:00
COPYRIGHT
engine.c Renumber copyright clause 4 2017-02-28 23:42:47 +00:00
Makefile.inc Replace use of ${.CURDIR} by ${LIBC_SRCTOP} and define ${LIBC_SRCTOP} 2014-03-04 02:19:39 +00:00
re_format.7 Remove SVR4 (System V Release 4) binary compatibility support. 2017-02-28 05:14:42 +00:00
regcomp.c Correct an out-of-bounds read in regcomp when the RE is bad. 2017-05-02 21:20:27 +00:00
regerror.c regex: unsign and constify some variables. 2017-04-23 21:51:29 +00:00
regex2.h regex: unsign and constify some variables. 2017-04-23 21:51:29 +00:00
regex.3 Renumber copyright clause 4 2017-02-28 23:42:47 +00:00
regexec.c regex: unsign and constify some variables. 2017-04-23 21:51:29 +00:00
regfree.c regex: unsign and constify some variables. 2017-04-23 21:51:29 +00:00
Symbol.map
utils.h Renumber copyright clause 4 2017-02-28 23:42:47 +00:00
WHATSNEW