Fix another memory leak in regexp compiler (BZ #17069)

diff --git a/ChangeLog b/ChangeLog
index 192217d40450c74def4d536c07b480fb4d34e018..6d419c156cd116a2853419a44dcdebdedb0ae11e 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2014-06-20  Andreas Schwab  <schwab@linux-m68k.org>
+
+       [BZ #17069]
+       * posix/regcomp.c (parse_reg_exp): Deallocate partially
+       constructed tree before returning error.
+       * posix/bug-regexp36.c: Expand test case.
+
 2014-06-20  Stefan Liebler  <stli@linux.vnet.ibm.com>
 
        [BZ #6803]

diff --git a/NEWS b/NEWS
index 5af9404756487e56f6544ac0de8036799702fd83..9c2ba43ab49055af4f311d3f55d83b4f7d09d9a0 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -20,7 +20,7 @@ Version 2.20
   16854, 16876, 16877, 16878, 16882, 16885, 16888, 16890, 16912, 16915,
   16916, 16917, 16922, 16927, 16928, 16932, 16943, 16958, 16965, 16966,
   16967, 16977, 16978, 16984, 16990, 16996, 17009, 17022, 17031, 17042,
-  17048, 17058, 17062.
+  17048, 17058, 17062, 17069.
 
 * Optimized strchr implementation for AArch64.  Contributed by ARM Ltd.
 

diff --git a/posix/bug-regex36.c b/posix/bug-regex36.c
index 3dda0265854a74a4fbb8d3bd5907f30640210e90..59e2b6d321e1abcd6d93e5b6e8977d85aa8f3230 100644 (file)
--- a/posix/bug-regex36.c
+++ b/posix/bug-regex36.c
@@ -1,4 +1,4 @@
-/* Test regcomp not leaking memory on invalid repetition operator
+/* Test regcomp not leaking memory on parse errors
    Copyright (C) 2014 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
 
@@ -24,6 +24,6 @@ main (int argc, char **argv)
 {
   regex_t r;
   mtrace ();
-  regcomp (&r, "[a]\\{-2,}", 0);
+  regcomp (&r, "[a]\\|[a]\\{-2,}", 0);
   regfree (&r);
 }

diff --git a/posix/regcomp.c b/posix/regcomp.c
index a5020be19296bbfa55bf3cce1d4ced7e14a3dee7..076eca3e7c74d712685503bc1efa676672e91c2b 100644 (file)
--- a/posix/regcomp.c
+++ b/posix/regcomp.c
@@ -2154,7 +2154,11 @@ parse_reg_exp (re_string_t *regexp, regex_t *preg, re_token_t *token,
        {
          branch = parse_branch (regexp, preg, token, syntax, nest, err);
          if (BE (*err != REG_NOERROR && branch == NULL, 0))
-           return NULL;
+           {
+             if (tree != NULL)
+               postorder (tree, free_tree, NULL);
+             return NULL;
+           }
        }
       else
        branch = NULL;