[Bug regex/17356] New: regex assertion violation with triple backreferences

["eggert at gnu dot org" <sourceware-bugzilla at sourceware dot org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=17356

            Bug ID: 17356
           Summary: regex assertion violation with triple backreferences
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: regex
          Assignee: unassigned at sourceware dot org
          Reporter: eggert at gnu dot org
                CC: drepper.fsp at gmail dot com
             Flags: security+

Created attachment 7772
  --> https://sourceware.org/bugzilla/attachment.cgi?id=7772&action=edit
Test for triple backreference regex bug

The attached program, which is a strictly conforming use of the POSIX regular
expression matcher, has undefined behavior with glibc.  On Fedora 20 x86-64 it
simply dumps core; on Ubuntu 14.04 x86-64 it outputs "regexec.c:1386:
pop_fail_stack: Assertion `num >= 0' failed" and then dumps core.  It works
fine on Solaris and AIX.

I expect that this bug has been in all glibc versions since Isamu Hasegawa's
circa-2002 rewrite of the regex code, and that the bug is in glibc 2.20 too,
though I haven't tested this.

Fixing this bug will not be trivial, I'm afraid.  I have not succeeded in
tracking down Mr. Hasegawa.

-- 
You are receiving this mail because:
You are on the CC list for the bug.