+2019-01-31 Paul Eggert <eggert@cs.ucla.edu>
+
+ regex: fix read overrun [BZ #24114]
+ Problem found by AddressSanitizer, reported by Hongxu Chen in:
+ https://debbugs.gnu.org/34140
+ * posix/regexec.c (proceed_next_node):
+ Do not read past end of input buffer.
+
2019-01-31 Florian Weimer <fweimer@redhat.com>
[BZ #24059]
(CFLAGS-wcstof_l.c): Likewise.
(CPPFLAGS-tst-wchar-h.c): Likewise.
(CPPFLAGS-wcstold_l.c): Likewise.
----
+
2017-12-11 Paul A. Clarke <pc@us.ibm.com>
* sysdeps/ieee754/flt-32/s_cosf.c: New implementation.
else if (naccepted)
{
char *buf = (char *) re_string_get_buffer (&mctx->input);
- if (memcmp (buf + regs[subexp_idx].rm_so, buf + *pidx,
- naccepted) != 0)
+ if (mctx->input.valid_len - *pidx < naccepted
+ || (memcmp (buf + regs[subexp_idx].rm_so, buf + *pidx,
+ naccepted)
+ != 0))
return -1;
}
}