aboutsummaryrefslogtreecommitdiff
path: root/posix/regexec.c
diff options
context:
space:
mode:
authorUlrich Drepper <drepper@gmail.com>2011-05-28 17:14:30 -0400
committerUlrich Drepper <drepper@gmail.com>2011-05-28 17:14:30 -0400
commit8887a920a4b81a500f54893250085e0d1a52cf9a (patch)
tree94355b4c7eefa011600c53ea0dcaaa8b152eacb6 /posix/regexec.c
parent4f031072a5055abd83717820b59efdaa463d5853 (diff)
downloadglibc-8887a920a4b81a500f54893250085e0d1a52cf9a.zip
glibc-8887a920a4b81a500f54893250085e0d1a52cf9a.tar.gz
glibc-8887a920a4b81a500f54893250085e0d1a52cf9a.tar.bz2
Fix unnecessary overallocation due to incomplete character
When incomplete characters are found at the end of a string the code ran amok and allocated lots of memory. Stricter limits are now in place.
Diffstat (limited to 'posix/regexec.c')
-rw-r--r--posix/regexec.c10
1 files changed, 6 insertions, 4 deletions
diff --git a/posix/regexec.c b/posix/regexec.c
index 8d4475c..9e0c565 100644
--- a/posix/regexec.c
+++ b/posix/regexec.c
@@ -1,5 +1,5 @@
/* Extended regular expression matching and search library.
- Copyright (C) 2002-2005, 2007, 2009, 2010 Free Software Foundation, Inc.
+ Copyright (C) 2002-2005,2007,2009,2010,2011 Free Software Foundation, Inc.
This file is part of the GNU C Library.
Contributed by Isamu Hasegawa <isamu@yamato.ibm.com>.
@@ -1156,7 +1156,8 @@ check_matching (re_match_context_t *mctx, int fl_longest_match,
re_dfastate_t *old_state = cur_state;
int next_char_idx = re_string_cur_idx (&mctx->input) + 1;
- if (BE (next_char_idx >= mctx->input.bufs_len, 0)
+ if ((BE (next_char_idx >= mctx->input.bufs_len, 0)
+ && mctx->input.bufs_len < mctx->input.len)
|| (BE (next_char_idx >= mctx->input.valid_len, 0)
&& mctx->input.valid_len < mctx->input.len))
{
@@ -1732,7 +1733,8 @@ clean_state_log_if_needed (re_match_context_t *mctx, int next_state_log_idx)
{
int top = mctx->state_log_top;
- if (next_state_log_idx >= mctx->input.bufs_len
+ if ((next_state_log_idx >= mctx->input.bufs_len
+ && mctx->input.bufs_len < mctx->input.len)
|| (next_state_log_idx >= mctx->input.valid_len
&& mctx->input.valid_len < mctx->input.len))
{
@@ -4111,7 +4113,7 @@ extend_buffers (re_match_context_t *mctx)
return REG_ESPACE;
/* Double the lengthes of the buffers. */
- ret = re_string_realloc_buffers (pstr, pstr->bufs_len * 2);
+ ret = re_string_realloc_buffers (pstr, MIN (pstr->len, pstr->bufs_len * 2));
if (BE (ret != REG_NOERROR, 0))
return ret;