Debian bug report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=779392 Reproducer from the Debian bug: #include <assert.h> #include <regex.h> #include <stdio.h> int main(int argc, char **argv) { int rc; regex_t preg; regmatch_t pmatch[2]; rc = regcomp(&preg, "()*)|\\1)*", REG_EXTENDED); assert(rc == 0); regexec(&preg, "", 2, pmatch, 0); regfree(&preg); return 0; } This was assigned CVE-2015-8985 even though it is debatable whether this is a security bug.
This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "GNU C Library master sources". The branch, master has been updated via eb04c21373e2a2885f3d52ff192b0499afe3c672 (commit) from b11643c21c5c9d67a69c8ae952e5231ce002e7f1 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=eb04c21373e2a2885f3d52ff192b0499afe3c672 commit eb04c21373e2a2885f3d52ff192b0499afe3c672 Author: Adhemerval Zanella <adhemerval.zanella@linaro.org> Date: Wed Dec 20 09:47:44 2017 -0200 posix: Sync gnulib regex implementation This patch syncs the regex implementation with gnulib (commit 0ee5212). Only two changes in GLIBC regex testing are required: 1. posix/bug-regex28.c: as previously discussed [1] the change of expected results on the pattern should be safe. 2. posix/PCRE.tests: the ERE (a)|\1 is malformed (in the sense that the \1 doesn't mean anything) and although current GLIBC accepts it has undefined behavior. This patch removes the specific test. This sync contains some patches from thread 'Regex: Make libc regex more usable outside GLIBC.' [2] which have been pushed upstream in gnulib. This patches also fixes some regex issues (BZ #23233, BZ #21163, BZ #18986, BZ #13762) and I did not add testcases for both #23233 and #13762 because I couldn't think a simple way to trigger the expected failure path to trigger them. Checked on x86_64-linux-gnu and i686-linux-gnu. [BZ #23233] [BZ #21163] [BZ #18986] [BZ #13762] * posix/Makefile (tests): Add bug-regex37 and bug-regex38. * posix/PCRE.tests: Remove invalid test. * posix/bug-regex28.c: Fix expected values for used syntax. * posix/bug-regex37.c: New file. * posix/bug-regex38.c: Likewise. * posix/regcomp.c: Sync with gnulib. * posix/regex.c: Likewise. * posix/regex.h: Likewise. * posix/regex_internal.c: Likewise. * posix/regex_internal.h: Likewise. * posix/regexec.c: Likewise. [1] https://sourceware.org/ml/libc-alpha/2017-12/msg00807.html [2] https://sourceware.org/ml/libc-alpha/2017-12/msg00237.html ----------------------------------------------------------------------- Summary of changes: ChangeLog | 18 + posix/Makefile | 3 +- posix/PCRE.tests | 13 - posix/bug-regex28.c | 46 +- wcsmbs/test-char-types.c => posix/bug-regex37.c | 11 +- wcsmbs/test-char-types.c => posix/bug-regex38.c | 11 +- posix/regcomp.c | 597 +++++++++------ posix/regex.c | 21 +- posix/regex.h | 335 +++++---- posix/regex_internal.c | 295 ++++---- posix/regex_internal.h | 442 ++++++++---- posix/regexec.c | 936 ++++++++++++----------- 12 files changed, 1557 insertions(+), 1171 deletions(-) copy wcsmbs/test-char-types.c => posix/bug-regex37.c (78%) copy wcsmbs/test-char-types.c => posix/bug-regex38.c (78%)
Fixed by eb04c21373e2a2885f3d52ff192b0499afe3c672 (2.28).
Fixed.