From: Bernhard Voelker <mail@bernhard-voelker.de>
Date: Wed, 13 Sep 2017 21:37:20 +0000 (+0200)
Subject: ptx: avoid infloop due to zero-length matches with -S regex
X-Git-Tag: v8.29~63
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=97c5045435f15c2bc984cc05bbfdca897bbdd284;p=thirdparty%2Fcoreutils.git

ptx: avoid infloop due to zero-length matches with -S regex

* src/ptx.c (find_occurs_in_text): Die with an appropriate error
diagnostic when the given regular expression returns a match of
length 0.
* tests/misc/ptx.pl (S-infloop): Add a test.
* NEWS (Bug fixes): Mention the fix.

Fixes https://bugs.gnu.org/28417 which was detected using
Symbolic Execution techniques developed in the course of the
SYMBIOSYS research project at COMSYS, RWTH Aachen University.
---

diff --git a/NEWS b/NEWS
index 8be22f169c..ca36063eb5 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,11 @@ GNU coreutils NEWS                                    -*- outline -*-
 
 * Noteworthy changes in release ?.? (????-??-??) [?]
 
+** Bug fixes
+
+  ptx -S no longer infloops for a pattern which returns zero-length matches.
+  [the bug dates back to the initial implementation]
+
 
 * Noteworthy changes in release 8.28 (2017-09-01) [stable]
 
diff --git a/src/ptx.c b/src/ptx.c
index 2aababff6d..b7aa1079b2 100644
--- a/src/ptx.c
+++ b/src/ptx.c
@@ -818,6 +818,11 @@ find_occurs_in_text (int file_index)
           case -1:
             break;
 
+          case 0:
+            die (EXIT_FAILURE, 0,
+                 _("error: regular expression has a match of length zero: %s"),
+                 quote (context_regex.string));
+
           default:
             next_context_start = cursor + context_regs.end[0];
             break;
diff --git a/tests/misc/ptx.pl b/tests/misc/ptx.pl
index d71d06500b..4d4e1c7292 100755
--- a/tests/misc/ptx.pl
+++ b/tests/misc/ptx.pl
@@ -40,6 +40,12 @@ my @Tests =
                               {OUT=>".xx \"\" \"\" \"foo\" \"\"\n"}],
 ["format-t", '--format=tex',  {IN=>"foo\n"},
                               {OUT=>"\\xx {}{}{foo}{}{}\n"}],
+
+# with coreutils-8.28 and earlier, the -S option would infloop with
+# matches of zero-length.
+["S-infloop", '-S ^', {IN=>"a\n"}, {EXIT=>1},
+                      {ERR_SUBST=>'s/^.*reg.*ex.*length zero.*$/regexlzero/'},
+                      {ERR=>"regexlzero\n"}],
 );
 
 @Tests = triple_test \@Tests;