The NetBSD Project

CVS log for src/lib/libc/regex/regcomp.c

[BACK] Up to [cvs.NetBSD.org] / src / lib / libc / regex

Request diff between arbitrary revisions


Default branch: MAIN
Current tag: netbsd-9-0-RELEASE


Revision 1.38 / (download) - annotate - [select for diffs], Thu Feb 7 22:22:31 2019 UTC (2 years ago) by christos
Branch: MAIN
CVS Tags: phil-wifi-20200421, phil-wifi-20200411, phil-wifi-20200406, phil-wifi-20191119, phil-wifi-20190609, netbsd-9-base, netbsd-9-1-RELEASE, netbsd-9-0-RELEASE, netbsd-9-0-RC2, netbsd-9-0-RC1, netbsd-9, is-mlppp-base, is-mlppp
Changes since 1.37: +6 -2 lines
Diff to previous 1.37 (colored)

Add some better error handling from FreeBSD, although we don't
suffer from the same issue, since we don't decrement p->next, like
FreeBSD does because we don't have multibyte support (yet). We
choose to do this so we can fail faster and more predictably.

Here's the original FreeBSD message:

When passed the invalid regular expression "a**", the error is
eventually detected and seterr() is called. It sets p->error
appropriatly and p->next and p->end to nuls which is a never used char
nuls[10] which is zeros due to .bss initialization. Unfortunatly,
p_ere_exp() and p_simp_re() both have fall through cases where they set
the error, decrement p->next and access it which means a read from what
ever .bss variable comes before nuls.

Found with regex_test:repet_multi and CHERI bounds checking.

Reviewed by:	ngie, pfg, emaste
Obtained from:	CheriBSD
Sponsored by:	DARPA, AFRL
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D10541

This form allows you to request diff's between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.




CVSweb <webmaster@jp.NetBSD.org>