AuroraMiddleware/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2024-11-27 07:20:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

regex: fix read overrun [BZ #24114]

Browse Source 
Problem found by AddressSanitizer, reported by Hongxu Chen in:
https://debbugs.gnu.org/34140
* posix/regexec.c (proceed_next_node):
Do not read past end of input buffer.

(cherry picked from commit 583dd860d5)
This commit is contained in:
Paul Eggert 2019-01-21 11:08:13 -08:00 committed by Aurelien Jarno
parent 4bf5ab3196
commit 2aee101ff6
2 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ChangeLog
View File

@ -1,3 +1,11 @@
2019-01-31 Paul Eggert <eggert@cs.ucla.edu>
regex: fix read overrun [BZ #24114]
Problem found by AddressSanitizer, reported by Hongxu Chen in:
https://debbugs.gnu.org/34140
* posix/regexec.c (proceed_next_node):
Do not read past end of input buffer.
2018-11-07 Andreas Schwab <schwab@suse.de>
[BZ #23864]

6
posix/regexec.c
View File

@ -1289,8 +1289,10 @@ proceed_next_node (const re_match_context_t *mctx, Idx nregs, regmatch_t *regs,
else if (naccepted)
{
char *buf = (char *) re_string_get_buffer (&mctx->input);
if (memcmp (buf + regs[subexp_idx].rm_so, buf + *pidx,
naccepted) != 0)
if (mctx->input.valid_len - *pidx < naccepted
|| (memcmp (buf + regs[subexp_idx].rm_so, buf + *pidx,
naccepted)
!= 0))
return -1;
}
}