1 commit f3a6cc0a560a17f32a3e90d2f20501a53cab6058
2 Author: Andreas Schwab <schwab@redhat.com>
3 Date: Tue Nov 29 10:52:22 2011 +0100
5 Fix access after end of search string in regex matcher
7 diff --git a/locale/weight.h b/locale/weight.h
8 index dc70a00..967e176 100644
12 -/* Copyright (C) 1996,1997,1998,1999,2000,2003,2004 Free Software Foundation, Inc.
13 +/* Copyright (C) 1996,1997,1998,1999,2000,2003,2004,2011 Free Software Foundation, Inc.
14 This file is part of the GNU C Library.
15 Written by Ulrich Drepper, <drepper@cygnus.com>.
18 /* Find index of weight. */
20 __attribute ((always_inline))
21 -findidx (const unsigned char **cpp)
22 +findidx (const unsigned char **cpp, size_t len)
24 int_fast32_t i = table[*(*cpp)++];
25 const unsigned char *cp;
26 @@ -34,6 +34,7 @@ findidx (const unsigned char **cpp)
27 Search for the correct one. */
34 @@ -56,7 +57,7 @@ findidx (const unsigned char **cpp)
38 - for (cnt = 0; cnt < nhere; ++cnt)
39 + for (cnt = 0; cnt < nhere && cnt < len; ++cnt)
40 if (cp[cnt] != usrc[cnt])
43 @@ -79,13 +80,13 @@ findidx (const unsigned char **cpp)
47 - for (cnt = 0; cnt < nhere; ++cnt)
48 + for (cnt = 0; cnt < nhere && cnt < len; ++cnt)
49 if (cp[cnt] != usrc[cnt])
54 - if (cp[cnt] > usrc[cnt])
55 + if (cnt == len || cp[cnt] > usrc[cnt])
57 /* Cannot be in this range. */
59 diff --git a/locale/weightwc.h b/locale/weightwc.h
60 index 9ea1126..7862091 100644
61 --- a/locale/weightwc.h
62 +++ b/locale/weightwc.h
64 -/* Copyright (C) 1996-2001,2003,2004,2005,2007 Free Software Foundation, Inc.
65 +/* Copyright (C) 1996-2001,2003,2004,2005,2007,2011 Free Software Foundation, Inc.
66 This file is part of the GNU C Library.
67 Written by Ulrich Drepper, <drepper@cygnus.com>.
70 /* Find index of weight. */
72 __attribute ((always_inline))
73 -findidx (const wint_t **cpp)
74 +findidx (const wint_t **cpp, size_t len)
76 wint_t ch = *(*cpp)++;
77 int32_t i = __collidx_table_lookup ((const char *) table, ch);
78 @@ -32,6 +32,7 @@ findidx (const wint_t **cpp)
79 /* Oh well, more than one sequence starting with this byte.
80 Search for the correct one. */
81 const int32_t *cp = (const int32_t *) &extra[-i];
86 @@ -54,7 +55,7 @@ findidx (const wint_t **cpp)
90 - for (cnt = 0; cnt < nhere; ++cnt)
91 + for (cnt = 0; cnt < nhere && cnt < len; ++cnt)
92 if (cp[cnt] != usrc[cnt])
95 @@ -75,7 +76,7 @@ findidx (const wint_t **cpp)
99 - for (cnt = 0; cnt < nhere - 1; ++cnt)
100 + for (cnt = 0; cnt < nhere - 1 && cnt < len; ++cnt)
101 if (cp[cnt] != usrc[cnt])
104 diff --git a/posix/fnmatch_loop.c b/posix/fnmatch_loop.c
105 index 18a6667..72bd3ee 100644
106 --- a/posix/fnmatch_loop.c
107 +++ b/posix/fnmatch_loop.c
108 @@ -412,7 +412,7 @@ FCT (pattern, string, string_end, no_leading_period, flags, ends, alloca_used)
109 _NL_CURRENT (LC_COLLATE, _NL_COLLATE_INDIRECTMB);
112 - idx = findidx (&cp);
113 + idx = findidx (&cp, 1);
116 /* We found a table entry. Now see whether the
117 @@ -422,7 +422,7 @@ FCT (pattern, string, string_end, no_leading_period, flags, ends, alloca_used)
119 const UCHAR *np = (const UCHAR *) n;
121 - idx2 = findidx (&np);
122 + idx2 = findidx (&np, string_end - n);
124 && (idx >> 24) == (idx2 >> 24)
125 && len == weights[idx2 & 0xffffff])
126 diff --git a/posix/regcomp.c b/posix/regcomp.c
127 index b238c08..34ee845 100644
128 --- a/posix/regcomp.c
129 +++ b/posix/regcomp.c
131 /* Extended regular expression matching and search library.
132 - Copyright (C) 2002-2007,2009,2010 Free Software Foundation, Inc.
133 + Copyright (C) 2002-2007,2009,2010,2011 Free Software Foundation, Inc.
134 This file is part of the GNU C Library.
135 Contributed by Isamu Hasegawa <isamu@yamato.ibm.com>.
137 @@ -3409,19 +3409,18 @@ build_equiv_class (bitset_t sbcset, const unsigned char *name)
138 _NL_COLLATE_EXTRAMB);
139 indirect = (const int32_t *) _NL_CURRENT (LC_COLLATE,
140 _NL_COLLATE_INDIRECTMB);
141 - idx1 = findidx (&cp);
142 - if (BE (idx1 == 0 || cp < name + strlen ((const char *) name), 0))
143 + idx1 = findidx (&cp, -1);
144 + if (BE (idx1 == 0 || *cp != '\0', 0))
145 /* This isn't a valid character. */
148 /* Build single byte matcing table for this equivalence class. */
149 - char_buf[1] = (unsigned char) '\0';
150 len = weights[idx1 & 0xffffff];
151 for (ch = 0; ch < SBC_MAX; ++ch)
155 - idx2 = findidx (&cp);
156 + idx2 = findidx (&cp, 1);
161 --- a/posix/regex_internal.h 2011-11-30 12:47:02.706567482 -0700
162 +++ a/posix/regex_internal.h 2011-11-30 12:47:32.969558337 -0700
164 indirect = (const int32_t *) _NL_CURRENT (LC_COLLATE,
165 _NL_COLLATE_INDIRECTMB);
167 - tmp = findidx (&p);
168 + tmp = findidx (&p, pstr->len - idx);
169 return p - pstr->mbs - idx;
172 diff --git a/posix/regexec.c b/posix/regexec.c
173 index 9e0c565..3ea810b 100644
174 --- a/posix/regexec.c
175 +++ b/posix/regexec.c
176 @@ -3924,7 +3924,7 @@ check_node_accept_bytes (const re_dfa_t *dfa, int node_idx,
177 _NL_CURRENT (LC_COLLATE, _NL_COLLATE_EXTRAMB);
178 indirect = (const int32_t *)
179 _NL_CURRENT (LC_COLLATE, _NL_COLLATE_INDIRECTMB);
180 - int32_t idx = findidx (&cp);
181 + int32_t idx = findidx (&cp, elem_len);
183 for (i = 0; i < cset->nequiv_classes; ++i)
185 diff --git a/string/strcoll_l.c b/string/strcoll_l.c
186 index d8d1139..fb77d08 100644
187 --- a/string/strcoll_l.c
188 +++ b/string/strcoll_l.c
190 -/* Copyright (C) 1995-1997,2002,2004,2007,2010 Free Software Foundation, Inc.
191 +/* Copyright (C) 1995-1997,2002,2004,2007,2010,2011 Free Software Foundation, Inc.
192 This file is part of the GNU C Library.
193 Written by Ulrich Drepper <drepper@gnu.org>, 1995.
195 @@ -205,7 +205,7 @@ STRCOLL (s1, s2, l)
197 while (*us1 != L('\0'))
199 - int32_t tmp = findidx (&us1);
200 + int32_t tmp = findidx (&us1, -1);
201 rule1arr[idx1max] = tmp >> 24;
202 idx1arr[idx1max] = tmp & 0xffffff;
204 @@ -267,7 +267,7 @@ STRCOLL (s1, s2, l)
206 while (*us2 != L('\0'))
208 - int32_t tmp = findidx (&us2);
209 + int32_t tmp = findidx (&us2, -1);
210 rule2arr[idx2max] = tmp >> 24;
211 idx2arr[idx2max] = tmp & 0xffffff;
213 diff --git a/string/strxfrm_l.c b/string/strxfrm_l.c
214 index 220253c..b06556d 100644
215 --- a/string/strxfrm_l.c
216 +++ b/string/strxfrm_l.c
217 @@ -176,7 +176,7 @@ STRXFRM (STRING_TYPE *dest, const STRING_TYPE *src, size_t n, __locale_t l)
221 - int32_t tmp = findidx (&usrc);
222 + int32_t tmp = findidx (&usrc, -1);
223 rulearr[idxmax] = tmp >> 24;
224 idxarr[idxmax] = tmp & 0xffffff;