From: Matthew Newton <matthew-git@newtoncomputing.co.uk>
Date: Thu, 27 Feb 2020 13:54:59 +0000 (+0000)
Subject: fix crash when no previous regex seen
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1bedaca611e758635385b08331cd7d4717c2ace5;p=thirdparty%2Ffreeradius-server.git

fix crash when no previous regex seen
---

diff --git a/src/lib/server/regex.c b/src/lib/server/regex.c
index d830b510a70..b5c7bdd918e 100644
--- a/src/lib/server/regex.c
+++ b/src/lib/server/regex.c
@@ -127,7 +127,7 @@ int regex_request_to_sub(TALLOC_CTX *ctx, char **out, REQUEST *request, uint32_t
 	if (!rc) {
 		RDEBUG4("No subcapture data found");
 		*out = NULL;
-		return 1;
+		return -1;
 	}
 	match_data = talloc_get_type_abort(rc->regmatch->match_data, pcre2_match_data);
 
@@ -198,7 +198,7 @@ int regex_request_to_sub_named(TALLOC_CTX *ctx, char **out, REQUEST *request, ch
 	if (!rc) {
 		RDEBUG4("No subcapture data found");
 		*out = NULL;
-		return 1;
+		return -1;
 	}
 	match_data = rc->regmatch->match_data;
 
@@ -266,7 +266,7 @@ int regex_request_to_sub(TALLOC_CTX *ctx, char **out, REQUEST *request, uint32_t
 	if (!rc) {
 		RDEBUG4("No subcapture data found");
 		*out = NULL;
-		return 1;
+		return -1;
 	}
 
 	ret = pcre_get_substring(rc->regmatch->subject,
@@ -335,7 +335,7 @@ int regex_request_to_sub_named(TALLOC_CTX *ctx, char **out, REQUEST *request, ch
 	if (!rc) {
 		RDEBUG4("No subcapture data found");
 		*out = NULL;
-		return 1;
+		return -1;
 	}
 
 	ret = pcre_get_named_substring(rc->preg->compiled, rc->regmatch->subject,
diff --git a/src/lib/server/xlat_builtin.c b/src/lib/server/xlat_builtin.c
index f4c55a5bcf3..1e1376a159d 100644
--- a/src/lib/server/xlat_builtin.c
+++ b/src/lib/server/xlat_builtin.c
@@ -2452,7 +2452,12 @@ static xlat_action_t xlat_func_regex(TALLOC_CTX *ctx, fr_cursor_t *out,
 		fr_value_box_t	*vb;
 		char		*p;
 
-		if (regex_request_to_sub(ctx, &p, request, 0) < 0) return XLAT_ACTION_FAIL;
+		if (regex_request_to_sub(ctx, &p, request, 0) < 0) {
+			REDEBUG2("No previous regex capture");
+			return XLAT_ACTION_FAIL;
+		}
+
+		rad_assert(p);
 
 		MEM(vb = fr_value_box_alloc_null(ctx));
 		fr_value_box_bstrsteal(vb, vb, NULL, p, false);
@@ -2482,7 +2487,12 @@ static xlat_action_t xlat_func_regex(TALLOC_CTX *ctx, fr_cursor_t *out,
 			return XLAT_ACTION_FAIL;
 		}
 
-		if (regex_request_to_sub(ctx, &p, request, idx.vb_uint32) < 0) return XLAT_ACTION_FAIL;
+		if (regex_request_to_sub(ctx, &p, request, idx.vb_uint32) < 0) {
+			REDEBUG2("No previous numbered regex capture group");
+			return XLAT_ACTION_FAIL;
+		}
+
+		rad_assert(p);
 
 		MEM(vb = fr_value_box_alloc_null(ctx));
 		fr_value_box_bstrsteal(vb, vb, NULL, p, false);
@@ -2504,7 +2514,12 @@ static xlat_action_t xlat_func_regex(TALLOC_CTX *ctx, fr_cursor_t *out,
 			return XLAT_ACTION_FAIL;
 		}
 
-		if (regex_request_to_sub_named(request, &p, request, (*in)->vb_strvalue) < 0) return XLAT_ACTION_FAIL;
+		if (regex_request_to_sub_named(request, &p, request, (*in)->vb_strvalue) < 0) {
+			REDEBUG2("No previous named regex capture group");
+			return XLAT_ACTION_FAIL;
+		}
+
+		rad_assert(p);
 
 		MEM(vb = fr_value_box_alloc_null(ctx));
 		fr_value_box_bstrsteal(vb, vb, NULL, p, false);
diff --git a/src/tests/keywords/if-regex-match-named b/src/tests/keywords/if-regex-match-named
index 6a8ef249e6c..5184e991bfb 100644
--- a/src/tests/keywords/if-regex-match-named
+++ b/src/tests/keywords/if-regex-match-named
@@ -3,6 +3,46 @@
 if (('${feature.regex-pcre}' == 'yes') || ('${feature.regex-pcre2}' == 'yes')) {
 update request {
 	&Tmp-Integer-0 := '123456789'
+	&Tmp-Integer-1 := 1
+}
+
+# Check failure when no previous capture - full capture
+if ("%{regex:}" != "") {
+	test_fail
+}
+
+if (&Module-Failure-Message[*] != "No previous regex capture") {
+	test_fail
+}
+
+update request {
+	&Module-Failure-Message !* ANY
+}
+
+# Check failure when no previous capture - named group
+if ("%{regex:foo}" != "") {
+	test_fail
+}
+
+if (&Module-Failure-Message[*] != "No previous named regex capture group") {
+	test_fail
+}
+
+update request {
+	&Module-Failure-Message !* ANY
+}
+
+# Check failure when no previous capture - numbered group
+if ("%{regex:%{Tmp-Integer-1}}" != "") {
+	test_fail
+}
+
+if (&Module-Failure-Message[*] != "No previous numbered regex capture group") {
+	test_fail
+}
+
+update request {
+	&Module-Failure-Message !* ANY
 }
 
 # uncompiled - ref - named capture groups