[PATCH] posix: fix false regex match with backrefs and $ anchor

[Collin Funk]

Carlos O'Donell <carlos@redhat.com> writes:

> On 4/12/26 3:39 PM, Collin Funk wrote:
>> This fixes the $ anchor being ignored in the following grep command:
>>      $ grep -E '^(.?)(.?).?\2\1$' <<< ab
>>      ab
>> However, the regular expression should only match palindromes.
>> This patch is mostly copied from a commit in Gnulib from Jim
>> Meyering
>> [1]. It was found by Ed Morton in GNU sed [2].
>> [1]
>> https://git.savannah.gnu.org/gitweb/?p=gnulib.git;a=commit;h=8c22765403cc34e87ad953cb3f6901e723c937f5
>> [2] https://bugs.gnu.org/68725
>
> May you please file a glibc bug for this so we can track?

Sure, I opened one now [1].

> Do you think this would have security impact?

Probably, since it is a false match. Though, in practice I'm not sure
how severe it is. I'm not sure how many security sensitive applications
are using backreferences like this.

Collin

[1] https://sourceware.org/bugzilla/show_bug.cgi?id=34073