Fix bad pointer / leak in regex code

This was found by Coverity (CID 1484201).  [BZ#24844]
* posix/regex_internal.c (create_cd_newstate): Fix use of bad
pointer and/or memory leak when storage is exhausted.

diff --git a/ChangeLog b/ChangeLog
index 5e07cee94124752faf317eb4a7ff6a6bf96bca8a..2db09d2f1883e457389e8c6b0db13c5825361b4f 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2019-08-21  Paul Eggert  <eggert@cs.ucla.edu>
+
+       Fix bad pointer / leak in regex code
+       This was found by Coverity (CID 1484201).  [BZ#24844]
+       * posix/regex_internal.c (create_cd_newstate): Fix use of bad
+       pointer and/or memory leak when storage is exhausted.
+
 2019-08-21  Zack Weinberg  <zackw@panix.com>
 
        * misc/syslog.c (__vsyslog_internal)

diff --git a/posix/regex_internal.c b/posix/regex_internal.c
index 9004ce809eb3cc96c7905242e15bf9e325e8cd60..f53ded93a8feade8a619f9cb723a95c734d3ed65 100644 (file)
--- a/posix/regex_internal.c
+++ b/posix/regex_internal.c
@@ -1716,15 +1716,19 @@ create_cd_newstate (const re_dfa_t *dfa, const re_node_set *nodes,
        {
          if (newstate->entrance_nodes == &newstate->nodes)
            {
-             newstate->entrance_nodes = re_malloc (re_node_set, 1);
-             if (__glibc_unlikely (newstate->entrance_nodes == NULL))
+             re_node_set *entrance_nodes = re_malloc (re_node_set, 1);
+             if (__glibc_unlikely (entrance_nodes == NULL))
                {
                  free_state (newstate);
                  return NULL;
                }
+             newstate->entrance_nodes = entrance_nodes;
              if (re_node_set_init_copy (newstate->entrance_nodes, nodes)
                  != REG_NOERROR)
-               return NULL;
+               {
+                 free_state (newstate);
+                 return NULL;
+               }
              nctx_nodes = 0;
              newstate->has_constraint = 1;
            }