This is the mail archive of the
libc-alpha@sourceware.org
mailing list for the glibc project.
[PATCH] regcomp: Fix off-by-one bug in build_equiv_class [BZ #23396]
- From: fweimer at redhat dot com (Florian Weimer)
- To: libc-alpha at sourceware dot org
- Date: Fri, 13 Jul 2018 17:35:40 +0200
- Subject: [PATCH] regcomp: Fix off-by-one bug in build_equiv_class [BZ #23396]
This bug is very similar to bug 23036: The existing code assumed that
the length count included the length byte itself.
2018-07-13 Florian Weimer <fweimer@redhat.com>
[BZ #23396]
* posix/regcomp.c (build_equiv_class): When comparing weights, do
not compare an extra byte after the end of the weights.
diff --git a/posix/regcomp.c b/posix/regcomp.c
index 7b5ddaad0c..545d188468 100644
--- a/posix/regcomp.c
+++ b/posix/regcomp.c
@@ -3531,18 +3531,10 @@ build_equiv_class (bitset_t sbcset, const unsigned char *name)
continue;
/* Compare only if the length matches and the collation rule
index is the same. */
- if (len == weights[idx2 & 0xffffff] && (idx1 >> 24) == (idx2 >> 24))
- {
- int cnt = 0;
-
- while (cnt <= len &&
- weights[(idx1 & 0xffffff) + 1 + cnt]
- == weights[(idx2 & 0xffffff) + 1 + cnt])
- ++cnt;
-
- if (cnt > len)
- bitset_set (sbcset, ch);
- }
+ if (len == weights[idx2 & 0xffffff] && (idx1 >> 24) == (idx2 >> 24)
+ && memcmp (weights + (idx1 & 0xffffff) + 1,
+ weights + (idx2 & 0xffffff) + 1, len) == 0)
+ bitset_set (sbcset, ch);
}
/* Check whether the array has enough space. */
if (BE (*equiv_class_alloc == mbcset->nequiv_classes, 0))