Recognize ill-formed { } expressions in regcomp.

(cherry picked from commit 52db8039f54672abe6a6da5fb107fa52aca42547)

diff --git a/ChangeLog b/ChangeLog
index e7c80bea1198aff0a40f436110328e63f8b585bd..876e0e8c3930356cd42e9a7e8f9a4a99c337f942 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,8 @@
 2009-08-23  Ulrich Drepper  <drepper@redhat.com>
 
+       * posix/regcomp.c (parse_dup_op): Verify the expression is correctly
+       terminated.
+
        * posix/unistd.h: Define _POSIX_VERSION and _POSIX2_* correctly if
        older POSIX versions are selected.
 

diff --git a/posix/regcomp.c b/posix/regcomp.c
index 4843cfea339b117b44234e643181f5af8e1ad5a7..446fed544588840c1475eb86442d5e1ff2b2bc77 100644 (file)
--- a/posix/regcomp.c
+++ b/posix/regcomp.c
@@ -2481,7 +2481,7 @@ parse_dup_op (bin_tree_t *elem, re_string_t *regexp, re_dfa_t *dfa,
          return elem;
        }
 
-      if (BE (end != -1 && start > end, 0))
+      if (BE ((end != -1 && start > end) || token->type != OP_CLOSE_DUP_NUM, 0))
        {
          /* First number greater than second.  */
          *err = REG_BADBR;