[PATCH] regexec: Fix off-by-one bug in weight comparison [BZ #23036]

[Dmitry V. Levin]

On Wed, Jul 11, 2018 at 04:43:41PM +0200, Florian Weimer wrote:
> Each weight is prefixed by its length, and the length does not include
> itself in the count.  This can be seen clearly from the find_idx
> function in string/strxfrm_l.c, for example.  The old code behaved as if
> the length itself counted, thus comparing an additional byte after the
> weight, leading to spurious comparison failures and incorrect further
> partitioning of character equivalence classes.
> 
> (cherry picked from commit 7b2f4cedf044ea83f53f6b43a5bf6871eb9ce969)
> 
> 2018-07-10  Florian Weimer  <fweimer@redhat.com>
> 
> 	[BZ #23036]
> 	* posix/regexec.c (check_node_accept_bytes): When comparing
> 	weights, do not compare an extra byte after the end of the
> 	weights.
> 
> diff --git a/NEWS b/NEWS
> index 2e7e7837ac..c5c78ffd3b 100644
> --- a/NEWS
> +++ b/NEWS
> @@ -69,6 +69,7 @@ The following bugs are resolved with this release:
>    [22947] FAIL: misc/tst-preadvwritev2
>    [22963] cs_CZ: Add alternative month names
>    [23005] Crash in __res_context_send after memory allocation failure
> +  [23036] regexec: Fix off-by-one bug in weight comparison
>    [23037] initialize msg_flags to zero for sendmmsg() calls
>    [23069] sigaction broken on riscv64-linux-gnu
>    [23102] Incorrect parsing of consecutive $ variables in runpath entries

Thanks for backporting this to 2.27.


-- 
ldv
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20180711/031f9d62/attachment.sig>