From 6ad813f67cad987471e4ab607e69e5dbaa74082a Mon Sep 17 00:00:00 2001
From: Steve Bennett <steveb@workware.net.au>
Date: Tue, 28 Jun 2011 07:24:07 +1000
Subject: Fix builtin regexp for memory overwrite

Reported-By: Spencer Oliver <spen@spen-soft.co.uk>
Signed-off-by: Steve Bennett <steveb@workware.net.au>
---
 jimregexp.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

(limited to 'jimregexp.c')

diff --git a/jimregexp.c b/jimregexp.c
index 8da9347..7725487 100644
--- a/jimregexp.c
+++ b/jimregexp.c
@@ -506,9 +506,11 @@ static int *regpiece(regex_t *preg, int *flagp)
 	else {
 		next = reginsert(preg, flags & SIMPLE ? REP: REPX, 5, ret);
 	}
-	ret[2] = max;
-	ret[3] = min;
-	ret[4] = 0;
+	if (preg->regcode != &regdummy) {
+		ret[2] = max;
+		ret[3] = min;
+		ret[4] = 0;
+	}
 
 	*flagp = (min) ? (WORST|HASWIDTH) : (WORST|SPSTART);
 
-- 
cgit v1.1