Bug 14780 – [PATCH] handle malloc() and realloc() failures in regcomp()

Bug 14780 - [PATCH] handle malloc() and realloc() failures in regcomp()


Summary:	[PATCH] handle malloc() and realloc() failures in regcomp()

Status:	NEW

Product:	glibc
Classification:	Unclassified
Component:	regex
Version:	unspecified

Importance:	P2 normal
Target Milestone:	---
Assigned To:	Not yet assigned to anyone

URL:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2012-10-28 13:26 UTC by Jindrich Makovicka
Modified:	2013-01-17 14:10 UTC (History)
CC List:	2 users (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:

Attachments
Patch for regcomp.c (13.93 KB, patch) 2012-10-28 13:26 UTC, Jindrich Makovicka	Details \| Diff
patch w/ malloc() fuzzing, used for testing (15.09 KB, patch) 2012-10-28 13:27 UTC, Jindrich Makovicka	Details \| Diff
test case (1.14 KB, text/x-csrc) 2012-10-28 13:28 UTC, Jindrich Makovicka	Details
handle malloc() and realloc() failures in regcomp() (15.88 KB, patch) 2012-10-28 14:42 UTC, Jindrich Makovicka	Details \| Diff
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Jindrich Makovicka 2012-10-28 13:26:59 UTC

Created attachment 6705 [details]
Patch for regcomp.c

Hi,

currently, regcomp() misses a lot of checks for memory allocation
failures, and it also does not properly release memory on error paths.
This means a malloc error usually causes either a SEGV or a memory
leak.

The attached patch (regex.diff) adds the return value checks and
memory deallocation on failures.

Comment 1 Jindrich Makovicka 2012-10-28 13:27:55 UTC

Created attachment 6706 [details]
patch w/ malloc() fuzzing, used for testing

Comment 2 Jindrich Makovicka 2012-10-28 13:28:28 UTC

Created attachment 6707 [details]
test case

Comment 3 Jindrich Makovicka 2012-10-28 13:28:54 UTC

I have been debugging this issue by fuzzing re_malloc() and
re_realloc(), making them randomly return NULL. The patch with added
fuzzing is attached as regex-fuzzed.diff . testcase.c has been used to
exercise the modified regcomp().
Memory violations or leaks have been tested using valgrind: valgrind
--leak-check=full --show-reachable=yes --trace-children=yes
./testrun.sh ./testcase

Comment 4 Jindrich Makovicka 2012-10-28 14:42:10 UTC

Created attachment 6708 [details]
handle malloc() and realloc() failures in regcomp()

patch updated for current glibc git

Comment 5 Siddhesh Poyarekar 2013-01-17 14:10:10 UTC

Thanks for the patch.  Please use the following wiki document as a guideline:

http://sourceware.org/glibc/wiki/Contribution%20checklist

and post your patch for review on the libc-alpha mailing list:

http://www.gnu.org/software/libc/development.html