From 27a317090771252c089acad12a67d26183eb1b5c Mon Sep 17 00:00:00 2001 From: pfg Date: Sat, 21 May 2016 19:54:10 +0000 Subject: [PATCH] libc/regex: fix two buffer underruns. Fix some rather complex regex issues found on OpenBSD as part of some ongoing work to fix a sed(1) bug. Curiously the OpenBSD tests don't trigger segfaults on FreeBSD but the bugs were confirmed by running a port of FreeBSD's regex under OpenBSD's malloc. Huge thanks to Ingo for confirming the behavior. Taken from: Ingo Schwarze (through openbsd-tech 2016-05-15) MFC after: 1 week --- lib/libc/regex/engine.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/lib/libc/regex/engine.c b/lib/libc/regex/engine.c index 77baa7e606c..d3affb99326 100644 --- a/lib/libc/regex/engine.c +++ b/lib/libc/regex/engine.c @@ -606,9 +606,9 @@ backref(struct match *m, return(NULL); break; case OBOL: - if ( (sp == m->beginp && !(m->eflags®_NOTBOL)) || - (sp < m->endp && *(sp-1) == '\n' && - (m->g->cflags®_NEWLINE)) ) + if ((sp == m->beginp && !(m->eflags®_NOTBOL)) || + (sp > m->offp && sp < m->endp && + *(sp-1) == '\n' && (m->g->cflags®_NEWLINE))) { /* yes */ } else return(NULL); @@ -622,12 +622,9 @@ backref(struct match *m, return(NULL); break; case OBOW: - if (( (sp == m->beginp && !(m->eflags®_NOTBOL)) || - (sp < m->endp && *(sp-1) == '\n' && - (m->g->cflags®_NEWLINE)) || - (sp > m->beginp && - !ISWORD(*(sp-1))) ) && - (sp < m->endp && ISWORD(*sp)) ) + if (sp < m->endp && ISWORD(*sp) && + ((sp == m->beginp && !(m->eflags®_NOTBOL)) || + (sp > m->offp && !ISWORD(*(sp-1))))) { /* yes */ } else return(NULL); -- 2.11.4.GIT