[PATCH] handle malloc() and realloc() failures in regcomp()

[Jindřich Makovička]

From: Jindřich Makovička <makovick@gmail.com>
Date: Sun, Oct 28, 2012 at 2:17 PM
Subject: [PATCH] handle malloc() and realloc() failures in regcomp()
To: patches@eglibc.org
Cc: Jindřich Makovička <makovick@gmail.com>

Hi,

currently, regcomp() misses a lot of checks for memory allocation
failures, and it also does not properly release memory on error paths.
This means a malloc error usually causes either a SEGV or a memory
leak.

The attached patch
(0001-handle-malloc-and-realloc-failures-in-regcomp.patch) adds the
return value checks and
memory deallocation on failures.

I have been debugging this issue by fuzzing re_malloc() and
re_realloc(), making them randomly return NULL. The patch with added
fuzzing is attached as regex-fuzzed.diff . testcase.c has been used to
exercise the modified regcomp().
Memory violations or leaks have been tested using valgrind: valgrind
--leak-check=full --show-reachable=yes --trace-children=yes
./testrun.sh ./testcase

Regards,
--
Jindřich Makovička
-------------- next part --------------
A non-text attachment was scrubbed...
Name: regex-fuzzed.diff
Type: application/octet-stream
Size: 15455 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20121028/06542402/attachment.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: testcase.c
Type: text/x-csrc
Size: 1170 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20121028/06542402/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-handle-malloc-and-realloc-failures-in-regcomp.patch
Type: application/octet-stream
Size: 16257 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20121028/06542402/attachment-0001.obj>