File regex-read-overrun.patch of Package glibc.14271
2019-01-31 Paul Eggert <eggert@cs.ucla.edu>
regex: fix read overrun [BZ #24114]
Problem found by AddressSanitizer, reported by Hongxu Chen in:
https://debbugs.gnu.org/34140
* posix/regexec.c (proceed_next_node):
Do not read past end of input buffer.
Index: glibc-2.26/posix/regexec.c
===================================================================
--- glibc-2.26.orig/posix/regexec.c
+++ glibc-2.26/posix/regexec.c
@@ -1304,8 +1304,10 @@ proceed_next_node (const re_match_contex
else if (naccepted)
{
char *buf = (char *) re_string_get_buffer (&mctx->input);
- if (memcmp (buf + regs[subexp_idx].rm_so, buf + *pidx,
- naccepted) != 0)
+ if (mctx->input.valid_len - *pidx < naccepted
+ || (memcmp (buf + regs[subexp_idx].rm_so, buf + *pidx,
+ naccepted)
+ != 0))
return -1;
}
}