[PATCH] Fix buffer overrun in regexp matcher

[Andreas Schwab]

Carlos O'Donell <carlos@systemhalted.org> writes:

> Thus MIN() never yields anything near double the length.

That is not true, otherwise the bug would not have happend.  bufs_len
starts out pretty small (MB_CUR_MAX).

> ret = re_string_realloc_buffers (pstr, min_len);
>
> Why wouldn't that just work?

It would work, but also causes a lot more reallocs since many uses go by
single steps.

Andreas.

-- 
Andreas Schwab, SUSE Labs, schwab@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE  1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."