Bug 25322

Summary:	regex mishandles back-references inside interval expressions
Product:	glibc	Reporter:	eggert
Component:	regex	Assignee:	Not yet assigned to anyone <unassigned>
Status:	NEW ---
Severity:	normal	CC:	afarabdelwahab, ahmedsayeed1982, ampva300, bhtrananh8, drepper.fsp, lexenluis, lmminformation2020, namboru, noithatduyanh.1990, sherrixotyv29
Priority:	P2	Flags:	fweimer: security-
Version:	2.30
Target Milestone:	---
Host:		Target:
Build:		Last reconfirmed:
Attachments:	C program illustrating bug with back-references inside intervals

Description eggert 2019-12-29 20:35:01 UTC

Created attachment 12153 [details]
C program illustrating bug with back-references inside intervals

The glibc regular expression code mishandles regular expressions such as:

   .*((.)\2){2}$

as it does not backtrack enough to find a match that satisfies the back-references when they are used twice.

To reproduce the problem, compile and run the attached file backrefbug.c. It will exit with status 2, whereas the correct exit status is 0.

This bug was originally reported against GNU 'grep' here:

https://bugs.gnu.org/26864

and you can find more test cases by reading that bug report.

Comment 1 Ahmed Sayeed 2021-05-25 19:52:12 UTC Comment hidden (spam)

The glibc regular expression code mishandles regular expressions such as:

   .*((.)\2){2}$

as it does not backtrack enough to find a match that satisfies the back-references when they are used twice.

To reproduce the problem, compile and run the attached file backrefbug.c. It will exit with status 2, whereas the correct exit status is 0. https://www.sjtreeservices.com/ https://www.junkremoval-portland.com/ https://www.westpalmbeachjunkremoval.com/ https://komiya-dental.com/ http://steemfilter.space/ http://michielleunens.tech/ http://sleepypoetstuff.website/ http://biciclubvalencia.website/ http://reputation-management.site/ http://pitesti.online/ http://tobuweb.space/ http://ancientmariners.online/ http://j70sanfranciscobay.website http://betwsycoednet.online http://kuzin.website http://kundaliniyoga.tech http://localpay.tech http://my-iframe.online

Comment 2 Leslie Brown 2021-06-15 23:40:15 UTC Comment hidden (spam)

I found below comment on one of the link and I think it will help:
On further thought, we shouldn't be encouraging palindromish REs in the manual,
so that naive users aren't drawn into this mess. So I installed the attached
further patch to the documentation.

Of course it would be better to fix the back-reference bugs but this is low
priority and I doubt whether anybody has the time.
[0001-doc-don-t-encourage-back-references.patch
credit to Sundeep if I remember the name right..
Thanks, Leslie of https://fencecompanylongbeach.com/

Comment 3 Ahmed Sayeed 2021-06-27 17:41:02 UTC Comment hidden (spam)

C program illustrating bug with back-references inside intervals

The glibc regular expression code mishandles regular expressions such as:

   .*((.)\2){2}$

as it does not backtrack enough to find a match that satisfies the back-references when they are used twice.

To reproduce the problem, compile and run the attached file backrefbug.c. It will exit with status 2, whereas the correct exit status is 0.

This bug was originally reported against GNU 'grep' here: 

https://komiya-dental.com/

Comment 4 lisa ray 2021-07-07 13:08:56 UTC Comment hidden (spam)

The glibc regular expression code mishandles regular expressions such as:

   .*((.)\2){2}$

as it does not backtrack enough to find a match that satisfies the back-references when they are used twice.

To reproduce the problem, compile and run the attached file backrefbug.c. It will exit with status 2, whereas the correct exit status is 0.
https://alphamedia.group/
https://chicagolandreplicarassociation.com/
https://gani.vn/
https://gurusattaking.com/
https://kanagawasuido.com/
https://kanagawasuido.jp/
https://kokoo.co.il/
https://mainoriti.com/
https://theweblv.com/
https://tuaserie.net/
https://ukauto.fr/
https://www.alovesinh.com/
https://www.caparison.jp/
https://www.lanovela.fr/
https://www.massage-vip-paris.fr/
https://www.maxihoster.com/
https://www.moxspellen.nl/
https://www.salonprivemag.com/
https://www.teastore.com/
https://www.vuabai9.com/
https://xemchuky.com/
https://zawajmsyar.com/

Comment 5 lisa ray 2021-07-07 13:48:58 UTC Comment hidden (spam)

https://www.duthuyen-halong.com/
https://tuvisomenh.com.vn/
https://devowl.io/de/wordpress-real-cookie-banner/borlabs-cookie-alternative/
https://xosomiennam.me/
https://alotech.vn/
https://domiktop.ru/
https://gpack.jp/
https://customembroiderycompany.com/
https://www.luathongduc.com/
https://iranpay.services/
http://boclaighesofatainha.com/
https://astroreflections.com/
https://www.trekkit.in/
https://randygoodwin.org/
https://nv.edu.vn/
https://legalbulletinnews.com/
http://xn--khnh-6na.vn/
https://mainoriti.com/
https://gamesmylittlepony.com/
https://alofarm.vn/
https://iwemon-press.com/travelmagazine
https://mobile-shuri.jp/
https://www.tonpvc.com/
https://polytheama.com/
https://poolcareexpert.com/
https://bextera.com/
https://www.onlinequrantuition.co.uk/
https://moonrayshop.com/
https://thanglongprinter.com/
https://cnktviettelbinhduong.com/
https://motorbikephanthiet.com/
https://www.productcompare.nl/
https://artizatechsol.com/
https://www.bew-web-agency.fr/agence-web-paris/
https://www.bew-web-agency.fr/creation-site-internet/
https://www.bew-web-agency.fr/creation-site-e-commerce-paris/
https://www.bew-web-agency.fr/refonte-site-internet/
https://www.bew-web-agency.fr/pack-referencement-naturel-local-seo/
https://www.bew-web-agency.fr/optimisation-referencement-seo/
https://www.bew-web-agency.fr/contact/
https://www.bew-web-agency.fr/demande-de-devis-gratuit/
https://www.bew-web-agency.fr/
https://svgdaily.com/
https://lightinfitness.com/
https://www.maisons-kernest.fr/
https://modradar.com/
https://daututhudong.com/
https://neolog888.com/
https://www.raizler.com.br/
https://www.amplicon.com.br/
https://www.graphgamesite.com/
https://gambleaddicts.com/
https://blog.sioricmt.com/
https://muaphutungoto.vn/
https://phutungotogiare.vn/
https://iphonenavi.com/
https://maytinhhadong.vn/
https://masterinstrumenta.ru/
https://carspa.vn/
https://www.testbank.shop/
https://clickproperty.sg/
https://kanagawasuido.jp/
https://kanagawasuido.com/
https://www.alovesinh.com/
https://www.moxspellen.nl/
https://ukauto.fr/
https://www.sportsante.info/comment-se-passe-losteopathie-a-paris-12/
https://bien-vivre.net/osteopathie-pourquoi-recourir-a-un-osteopathe-a-paris-12/
https://www.simurenov.fr/2021/06/14/quel-est-le-prix-dune-renovation-avec-une-entreprise-de-gros-oeuvre/
https://youngandstyle.fr/demolition-batiment-tout-ce-quil-faut-savoir/
https://www.blogtecnologia.com.es/soldadura-por-puntos-principio-ventajas-e-inconvenientes/
https://www.lesbricoleriesdenanie.fr/soudure-par-point-principe-avantages-et-inconvenients/
https://www.fair-news.de/2869418/punktschweissen-prinzip-vorteile-und-nachteile
https://hosonhanvat.net/
https://emiten.com/
https://chonkeo.net/
https://obligasi.com/
https://gethinh.net/
https://mygear.vn/
https://davicostone.net/
https://www.massage-vip-paris.fr/
https://gani.vn/
https://vietnammotorcycletours.com/
https://healthproduct.pro/
http://dichthuat.co/
https://washingtonbiz.us/spot-welding-principle-advantages-and-disadvantages/
https://giaytoxe.vn/
https://cameraviet.vn/
https://www.kneeosteotomy.org/
https://www.superweb.com.my/
I found below comment on one of the link and I think it will help:
On further thought, we shouldn't be encouraging palindromish REs in the manual,
so that naive users aren't drawn into this mess. So I installed the attached
further patch to the documentation.

Of course it would be better to fix the back-reference bugs but this is low
priority and I doubt whether anybody has the time.
[0001-doc-don-t-encourage-back-references.patch
credit to Sundeep if I remember the name right..
Thanks, Leslie of
https://avinu.co.il/
https://www.stylomatchmakers.com/
https://tuaserie.net/
https://gurusattaking.com/
https://zawajmsyar.com/
https://alphamedia.group/
https://www.teastore.com/
https://www.vuabai9.com/
https://panel-kaitori.com/
https://ecomoba.jp/
https://illico-rachat-auto.fr/
https://topaze-immobilier.com/
http://phongthumt.com/
https://sieuthidecor.net/
https://thanhngophat.com/
http://phongthuamtphcm.com/
https://bikkeioz.com/
https://xemchuky.com/
https://www.lanovela.fr/
https://chicagolandreplicarassociation.com/
https://theweblv.com/
https://www.salonprivemag.com/
https://kokoo.co.il/
https://www.caparison.jp/
https://www.maxihoster.com/

Comment 6 lisa ray 2021-07-08 02:21:19 UTC Comment hidden (spam)

https://guland.vn/
https://x1000.vn/
https://kirakulabo.info/
https://giupbanlamgiau.com/
https://maula.vn/
https://dailyotovinfast.com.vn/
https://outsourcingvn.com/
https://www.investissement-en-bourse.fr/
https://www.coffeetablestore.co.uk/
https://www.tinnitusmiracletreatments.com/
https://www.floralartflorists.co.uk/
https://vaycucde.net/
https://inoxanhduy.com/
https://fi88.one/
https://lemonacademy.co.uk/
https://www.trollhattansaab.net/
https://www.cherada.net/opus/creacion-de-cuentas-verificadas-de-gmail
https://teeherivar.com/
https://www.bhamlimousine.com/
http://cargoholidays.com/

Comment 7 lisa ray 2021-07-12 16:33:49 UTC Comment hidden (spam)

https://holy.com.vn/
https://netorama.fr/
https://www.fashion4mec.com/
https://www.moviereview.work/
https://khoruou68.com/
https://gamesgulf.com/
https://proreviewsapp.com/
https://sieuinan.com/
https://noithatduongdai.vn/
https://digital-and-health-consulting.com/
https://joker123th.vip/
https://joker123.center/
https://wearproof.com.au/
https://diaocbaotin.vn/
https://anhem888.com/

Comment 8 Joe Anderson 2021-07-13 00:17:55 UTC Comment hidden (spam)

Anu updates on how to fix this bug? Please let us know at https://www.columbusdrywallpros.com/

Comment 9 Sherry 2021-07-15 01:14:47 UTC Comment hidden (spam)

Implement it by moving target_unpush_up to target.h, so it can be https://www.kitchenremodelhawaii.com
    re-used here.  Make procfs_target::attach use it.  Note that just like
    is mentioned in inf_ptrace_target::attach, we should push the target
    before calling target_pid_to_str, so that calling target_pid_to_str ends
    up in procfs_target::pid_to_str.

Comment 10 goda omar 2021-07-16 13:50:01 UTC Comment hidden (spam)

تعود دقة أفضل [url=https://almalmachine.com/free-saudi-stock-analysis-program/]برنامج تحليل الأسهم السعودية مجانا[/url]
ة 2021 إلى مجموعة الخدمات التي يقدمها لك ، بغض النظر عما إذا كان رأيه صحيحًا أم لا. أي الأسهم ستعكس اتجاهها - سعر الغد - اتجاه السيولة - التجميع - التصحيح - الانهيار - توقعات الحلال - أدنى وأعلى وأسعار الإغلاق ، غدًا والأسبوع المقبل ... وهكذا.

Comment 11 goda omar 2021-07-16 13:51:34 UTC Comment hidden (spam)

تعود دقة أفضل برنامج مجاني لتحليل الأسهم السعودية 2020 إلى مجموعة الخدمات التي يقدمها لك ، بغض النظر عما إذا كان رأيه صحيحًا أم لا. أي الأسهم ستعكس اتجاهها - سعر الغد - اتجاه السيولة - التجميع - التصحيح - الانهيار - توقعات الحلال - أدنى وأعلى وأسعار الإغلاق ، غدًا والأسبوع المقبل ... وهكذا.
<a href="https://almalmachine.com/free-saudi-stock-analysis-program/">برنامج تحليل الأسهم السعودية مجانا</a>

Comment 12 goda omar 2021-07-16 13:52:05 UTC Comment hidden (spam)

<a href="https://almalmachine.com/free-saudi-stock-analysis-program/">برنامج تحليل الأسهم السعودية مجانا</a>
تعود دقة أفضل برنامج مجاني لتحليل الأسهم السعودية 2020 إلى مجموعة الخدمات التي يقدمها لك ، بغض النظر عما إذا كان رأيه صحيحًا أم لا. أي الأسهم ستعكس اتجاهها - سعر الغد - اتجاه السيولة - التجميع - التصحيح - الانهيار - توقعات الحلال - أدنى وأعلى وأسعار الإغلاق ، غدًا والأسبوع المقبل ... وهكذا.

Comment 13 lisa ray 2021-07-16 17:21:22 UTC Comment hidden (spam)

https://veryceleb.com/
https://growwork.co.jp/
https://www.ozeebeekeeping.com.au/
https://vestesoftshell.fr/
https://guland.vn/
http://rockvillesedationdentistryplus.com/
https://pic1s.com/
https://pic1s.com/shutterstock
https://barrazacarlos.com/

Comment 14 lisa ray 2021-07-18 10:32:34 UTC Comment hidden (spam)

https://noithatledinh.vn/
https://pranaspabali.com/
https://kubet.pro/
https://tramhuongphuclinh.vn
https://vietnammotorbiketour.com/
https://ilota.vn/
https://bdatrip.com/
https://xanthitoday.gr/
https://www.admissionschool.com/
https://hsm-plomberie-bellegarde.fr/
https://crane-nation.fr/bague-tete-de-mort/
https://www.daazcavernas.com/

Comment 15 Sherry 2021-07-21 03:36:01 UTC Comment hidden (spam)

The glibc regular expression code mishandles regular expressions such as: https://www.screenenclosure-miami.com/

   .*((.)\2){2}$

as it does not backtrack enough to find a match that satisfies the back-references when they are used twice.

Comment 16 lisa ray 2021-07-21 07:59:34 UTC Comment hidden (spam)

https://yeshouse.com.vn/
https://trucs-utiles.fr/
https://bestparentingbooks.org/
https://anime-hoodie.com/ahegao-hoodie/
https://kawuk.com/
https://www.rentmyskill.club/
https://purtierriway.com/
https://xpatin.com/
https://www.binoption.net/
https://budget-finance.com/
https://www.immovogel.lu/

Comment 17 namboru 2021-07-24 00:15:09 UTC Comment hidden (spam)

https://seohandal.id/jasa-seo-terpercaya/
https://seohandal.id/jasa-seo-bergaransi-uang-kembali/
https://seohandal.id/jasa-seo-murah-bergaransi-halaman-1-google/

Comment 18 bh ta 2021-07-24 02:36:16 UTC Comment hidden (spam)

https://vinfastnewway.com.vn/
https://chevroletphumyhung.org/

Comment 19 lisa ray 2021-07-25 08:36:01 UTC Comment hidden (spam)

https://annuaire2mode.fr/
https://quoi2neuf.fr/
https://www.lejeanshomme.fr/
https://www.levetementhomme.fr/
https://www.reference-appro.com/

Comment 20 lisa ray 2021-07-26 13:01:19 UTC Comment hidden (spam)

https://gatherbaltimore.org/
https://marketstreetcatch.com/
https://www.simplyfurnituredirect.com/
https://www.livingroom-sofas.com/
https://www.mydiningfurniture.com/
https://www.sellmyhousefastdallas.org/
https://www.adamholzman.net/private-teaching/
http://adamholzmanclassicalguitar.com/
https://austinclassicalguitarist.com/
https://we-buy-houses-business-directory.com/
https://proreviewsapp.com/
https://www.le-guily-services-construction.fr/
https://polotsk-portal.ru/

Comment 21 Linda 2021-07-28 07:24:55 UTC Comment hidden (spam)

The glibc regular expression code mishandles regular expressions such as:

   .*((.)\2){2}$

as it does not backtrack enough to find a match that satisfies the back-references when they are used twice.

To reproduce the problem, compile and run the attached file backrefbug.c. It will exit with status 2, whereas the correct exit status is 0.
<a href="https://noithatlongvu.com/">https://noithatlongvu.com/</a>
<a href="https://noithatlongvu.com/tin-tuc/ghe-chiavari-xu-huong-moi-cho-cac-nha-rap/">https://noithatlongvu.com/tin-tuc/ghe-chiavari-xu-huong-moi-cho-cac-nha-rap/</a>
<a href="https://inoxduyanh.com/">https://inoxduyanh.com/</a>
<a href="https://inoxduyanh.com/tin-tuc/ghe-chiavari-tiffany-chivas-nhap-khau-nha-hang-tiec-cuoi-gia-re/">https://inoxduyanh.com/tin-tuc/ghe-chiavari-tiffany-chivas-nhap-khau-nha-hang-tiec-cuoi-gia-re/</a>
<a href="https://inoxanhduy.com/ghe-chiavari-tiffany-mau-ghe-tiec-cuoi-dinh-cao-nhat-hien-nay/">https://inoxanhduy.com/ghe-chiavari-tiffany-mau-ghe-tiec-cuoi-dinh-cao-nhat-hien-nay/</a>

Comment 22 lisa ray 2021-07-30 04:33:21 UTC Comment hidden (spam)

https://gnptimes.in/
https://kinhcuongluclegia.vn/
https://www.tonthanhcong.vn/
https://dagathomo.bet/
https://ae288.net/
https://188kubet.com/
http://isweedlegalyet.info/
https://tuyenmai.com/
https://ditulis.id/
https://www.vizgazszerelo.hu/

Comment 23 lisa ray 2021-08-03 12:15:07 UTC Comment hidden (spam)

https://mlkyachts.com/
https://www.gemius.fr/
https://btshop.vn/
https://www.permismaison.fr/
https://www.surecheckup.com/
https://www.987thepeak.com/
https://truyenff.net/
https://fabet77.net
https://cf68.live/
https://www.ankhanggroup.com/
https://www.surecheckup.com/
https://safari-inugandamurchisonfalls.com/
https://vaytieniphone.vn/
https://leutrai.vn/