[PATCH] posix: fix false regex match with backrefs and $ anchor

[Florian Weimer]

* Collin Funk:

> Carlos O'Donell <carlos@redhat.com> writes:
>
>> On 4/12/26 3:39 PM, Collin Funk wrote:
>>> This fixes the $ anchor being ignored in the following grep command:
>>>      $ grep -E '^(.?)(.?).?\2\1$' <<< ab
>>>      ab
>>> However, the regular expression should only match palindromes.
>>> This patch is mostly copied from a commit in Gnulib from Jim
>>> Meyering
>>> [1]. It was found by Ed Morton in GNU sed [2].
>>> [1]
>>> https://git.savannah.gnu.org/gitweb/?p=gnulib.git;a=commit;h=8c22765403cc34e87ad953cb3f6901e723c937f5
>>> [2] https://bugs.gnu.org/68725
>>
>> May you please file a glibc bug for this so we can track?
>
> Sure, I opened one now [1].
>
>> Do you think this would have security impact?
>
> Probably, since it is a false match. Though, in practice I'm not sure
> how severe it is. I'm not sure how many security sensitive applications
> are using backreferences like this.

I think we've quite a few bugs like this, and none of the seemed to have
security implications in actual applications.  We need to draw a line
somewhere.  If every bug becomes a security vulnerability, the
distinction becomes meaningless.

Thanks,
Florian