Skip site navigation (1)Skip section navigation (2) 
Date:      Sun, 29 May 2016 16:32:21 +0000 (UTC)
From:      "Pedro F. Giffuni" <pfg@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org
Subject:   svn commit: r300963 - stable/10/lib/libc/regex
Message-ID:  <201605291632.u4TGWLJe031813@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: pfg
Date: Sun May 29 16:32:21 2016
New Revision: 300963
URL: https://svnweb.freebsd.org/changeset/base/300963

Log:
  MFC r300378:
  libc/regex: fix two buffer underruns.
  
  Fix some rather complex regex issues found on OpenBSD as part of some
  ongoing work to fix a sed(1) bug.
  
  Curiously the OpenBSD tests don't trigger segfaults on FreeBSD but the
  bugs were confirmed by running a port of FreeBSD's regex under OpenBSD's
  malloc. Huge thanks to Ingo for confirming the behavior.
  
  Obtained from:	OpenBSD (CVS 1.20, 1.21)

Modified:
  stable/10/lib/libc/regex/engine.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/lib/libc/regex/engine.c
==============================================================================
--- stable/10/lib/libc/regex/engine.c	Sun May 29 16:22:29 2016	(r300962)
+++ stable/10/lib/libc/regex/engine.c	Sun May 29 16:32:21 2016	(r300963)
@@ -606,9 +606,9 @@ backref(struct match *m,
 				return(NULL);
 			break;
 		case OBOL:
-			if ( (sp == m->beginp && !(m->eflags&REG_NOTBOL)) ||
-					(sp < m->endp && *(sp-1) == '\n' &&
-						(m->g->cflags&REG_NEWLINE)) )
+			if ((sp == m->beginp && !(m->eflags&REG_NOTBOL)) ||
+			    (sp > m->offp && sp < m->endp &&
+			    *(sp-1) == '\n' && (m->g->cflags&REG_NEWLINE)))
 				{ /* yes */ }
 			else
 				return(NULL);
@@ -622,12 +622,9 @@ backref(struct match *m,
 				return(NULL);
 			break;
 		case OBOW:
-			if (( (sp == m->beginp && !(m->eflags&REG_NOTBOL)) ||
-					(sp < m->endp && *(sp-1) == '\n' &&
-						(m->g->cflags&REG_NEWLINE)) ||
-					(sp > m->beginp &&
-							!ISWORD(*(sp-1))) ) &&
-					(sp < m->endp && ISWORD(*sp)) )
+			if (sp < m->endp && ISWORD(*sp) &&
+			    ((sp == m->beginp && !(m->eflags&REG_NOTBOL)) ||
+			    (sp > m->offp && !ISWORD(*(sp-1)))))
 				{ /* yes */ }
 			else
 				return(NULL);

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201605291632.u4TGWLJe031813>