|
 |
d8307d |
commit 58559f14437d2aa71753a29fed435efa06aa4576
|
|
|
d8307d |
Author: Paul Eggert <eggert@cs.ucla.edu>
|
|
|
d8307d |
Date: Tue Aug 28 21:54:28 2018 +0200
|
|
|
d8307d |
|
|
|
d8307d |
regex: fix uninitialized memory access
|
|
|
d8307d |
|
|
|
d8307d |
I introduced this bug into gnulib in commit
|
|
|
d8307d |
8335a4d6c7b4448cd0bcb6d0bebf1d456bcfdb17 dated 2006-04-10;
|
|
|
d8307d |
eventually it was merged into glibc. The bug was found by
|
|
|
d8307d |
project-repo <bugs@feusi.co> and reported here:
|
|
|
d8307d |
https://lists.gnu.org/r/sed-devel/2018-08/msg00017.html
|
|
|
d8307d |
Diagnosis and draft fix reported by Assaf Gordon here:
|
|
|
d8307d |
https://lists.gnu.org/r/bug-gnulib/2018-08/msg00071.html
|
|
|
d8307d |
https://lists.gnu.org/r/bug-gnulib/2018-08/msg00142.html
|
|
|
d8307d |
* posix/regex_internal.c (build_wcs_upper_buffer):
|
|
|
d8307d |
Fix bug when mbrtowc returns 0.
|
|
|
d8307d |
|
|
|
d8307d |
(cherry picked from commit bc680b336971305cb39896b30d72dc7101b62242)
|
|
|
d8307d |
|
|
|
d8307d |
diff --git a/posix/regex_internal.c b/posix/regex_internal.c
|
|
|
d8307d |
index 7f0083b918de6530..b10588f1ccbb1992 100644
|
|
|
d8307d |
--- a/posix/regex_internal.c
|
|
|
d8307d |
+++ b/posix/regex_internal.c
|
|
|
d8307d |
@@ -317,7 +317,7 @@ build_wcs_upper_buffer (re_string_t *pstr)
|
|
|
d8307d |
mbclen = __mbrtowc (&wc,
|
|
|
d8307d |
((const char *) pstr->raw_mbs + pstr->raw_mbs_idx
|
|
|
d8307d |
+ byte_idx), remain_len, &pstr->cur_state);
|
|
|
d8307d |
- if (BE (mbclen < (size_t) -2, 1))
|
|
|
d8307d |
+ if (BE (0 < mbclen && mbclen < (size_t) -2, 1))
|
|
|
d8307d |
{
|
|
|
d8307d |
wchar_t wcu = __towupper (wc);
|
|
|
d8307d |
if (wcu != wc)
|
|
|
d8307d |
@@ -386,7 +386,7 @@ build_wcs_upper_buffer (re_string_t *pstr)
|
|
|
d8307d |
else
|
|
|
d8307d |
p = (const char *) pstr->raw_mbs + pstr->raw_mbs_idx + src_idx;
|
|
|
d8307d |
mbclen = __mbrtowc (&wc, p, remain_len, &pstr->cur_state);
|
|
|
d8307d |
- if (BE (mbclen < (size_t) -2, 1))
|
|
|
d8307d |
+ if (BE (0 < mbclen && mbclen < (size_t) -2, 1))
|
|
|
d8307d |
{
|
|
|
d8307d |
wchar_t wcu = __towupper (wc);
|
|
|
d8307d |
if (wcu != wc)
|