[PATCH] regcomp: fix double free in parse_bracket_exp()

[Florian Weimer]

* Paul Eggert:

> On 2025-06-26 07:34, Florian Weimer wrote:
>> * Anastasia Belova:
>>> Double free happens when work_tree = NULL: before the check
>>> and after parse_bracket_exp_free_return free_charset() is called.
>>> Move first call after the check and goto.
>> Do you have a test case for this?
>
> It'd be hard to write a test case for this, as the bug occurs only
> when the code runs out of heap space at exactly the wrong time.

It's actually straightforward to write a test for this.  I've taken your
patch and adapted it to the current glibc sources:

  [PATCH] posix: Fix double-free after allocation failure in regcomp (bug 33185)
  <https://inbox.sourceware.org/libc-alpha/lhuy0sk19xh.fsf@oldenburg.str.redhat.com/>

Anastasia, thanks for reporting this.

Florian